Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-31218: Insufficient Information (NVD-CWE-noinfo)
value: Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and earlier are subject to Missing Authentication for Critical Function vulnerability. This vulnerability allows an unauthenticated attacker to send a HTTP request to the database (Pocketbase) admin API to create an admin account. The Pocketbase admin API does not check for authentication/authorization when creating an admin account when no admin accounts have been added. In its default deployment, Webhood does not create a database admin account. Therefore, unless users have manually created an admin account in the database, an admin account will not exist in the deployment and the deployment is vulnerable. Versions starting from 0.9.1 are patched. The patch creates a randomly generated admin account if admin accounts have not already been created i.e. the vulnerability is exploitable in the deployment. As a workaround, users can disable access to URL path starting with `/api/admins` entirely. With this workaround, the vulnerability is not exploitable via network.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-05T15:15Z
Repository: https://github.com/webhood-io/webhood
Language: JavaScript
Files changed: src/backend/migrations/1712252550_generate_random_admin.js
Commit date: 2024-04-04 20:54:42 +0300
Commit message: fix: generate random admin account on pocketbase if one does not exist

Diff: diff --git a/src/backend/migrations/1712252550_generate_random_admin.js b/src/backend/migrations/1712252550_generate_random_admin.js
new file mode 100644
index 0000000..6e1967c
--- /dev/null
+++ b/src/backend/migrations/1712252550_generate_random_admin.js
@@ -0,0 +1,20 @@
+migrate((db) => {
+  const dao = new Dao(db)
+  const totalAdmins = dao.totalAdmins()
+  if (totalAdmins > 0) {
+    return
+  }
+
+  const admin = new Admin()
+  admin.email = "admin@localhost"
+  admin.password = [...Array(30)].map(() => (Math.random() +1).toString(36)[2]).join('')
+
+  return dao.saveAdmin(admin)
+}, (db) => {
+  const dao = new Dao(db)
+  const admin = dao.findAdminByEmail("admin@localhost")
+  if(!admin) {
+    return
+  }
+  return dao.deleteAdmin(admin)
+})

Fixed code: migrate((db) => {
  const dao = new Dao(db)
  const totalAdmins = dao.totalAdmins()
  if (totalAdmins > 0) {
    return
  }

  const admin = new Admin()
  admin.email = "admin@localhost"
  admin.password = [...Array(30)].map(() => (Math.random() +1).toString(36)[2]).join('')

  return dao.saveAdmin(admin)
}, (db) => {
  const dao = new Dao(db)
  const admin = dao.findAdminByEmail("admin@localhost")
  if(!admin) {
    return
  }
  return dao.deleteAdmin(admin)
})
CVE-2016-1202: Other (NVD-CWE-Other)
value: Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2016-04-25T18:59Z
Repository: https://github.com/electron/electron
Language: Unknown
Commit date: 2015-10-03 21:20:19 +0800
Commit message: Merge pull request #2976 from atom/node_modules_paths

Prevent Node from adding paths outside the app to search paths
CVE-2018-1000118: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2018-03-07T14:29Z
Repository: https://github.com/electron/electron
Language: C++
Files changed: atom/app/command_line_args.cc
Commit date: 2018-01-31 17:35:09 -0700
Commit message: Use case-insensitive switch comparisons

Diff: diff --git a/atom/app/command_line_args.cc b/atom/app/command_line_args.cc
index d7426de7d..e83eed46f 100644
--- a/atom/app/command_line_args.cc
+++ b/atom/app/command_line_args.cc
@@ -1388,11 +1388,12 @@ bool IsBlacklistedArg(const base::CommandLine::CharType* arg) {
     }
   }
 
   if (prefix_length > 0) {
     a += prefix_length;
-    std::string switch_name(a, strcspn(a, "="));
+    std::string switch_name =
+        base::ToLowerASCII(base::StringPiece(a, strcspn(a, "=")));
     auto* iter = std::lower_bound(std::begin(kBlacklist), std::end(kBlacklist),
                                   switch_name);
     if (iter != std::end(kBlacklist) && switch_name == *iter) {
       return true;
     }

Vulnerable code:     std::string switch_name(a, strcspn(a, "="));
Fixed code:     std::string switch_name =
        base::ToLowerASCII(base::StringPiece(a, strcspn(a, "=")));
CVE-2023-2954: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-05-29T07:15Z
Repository: https://github.com/liangliangyy/djangoblog
Language: Unknown
Commit date: 2023-05-29 13:06:45 +0800
Commit message: Merge pull request #662 from liangliangyy/dev

fix xss
CVE-2020-11683: Observable Discrepancy (CWE-203)
value: A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC values and subsequently boot arbitrary code on an affected system.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 6.8
Published: 2020-09-14T14:15Z
Repository: https://github.com/linux4sam/at91bootstrap
Language: C
Files changed: driver/secure.c
Commit date: 2020-03-30 13:57:15 +0300
Commit message: driver: secure: use consttime_memequal for memory comparison

Do  not  use memcmp() to compare security critical data, such as
cryptographic secrets, because the required CPU time depends on the
number of equal bytes.
Instead, a function that performs comparisons in constant time is required.
Warning: consttime_memequal returns 0 if data are NOT equal, and 1 if they are
equal.

Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Reviewed-by: Nicolas Ferre <nicolas.ferre@microchip.com>

Diff: diff --git a/driver/secure.c b/driver/secure.c
index cd4dc88..ffb38e0 100644
--- a/driver/secure.c
+++ b/driver/secure.c
@@ -101,11 +101,11 @@ int secure_decrypt(void *data, unsigned int data_length, int is_signed)
 			goto exit;
 
 		/* Check the CMAC */
 		fixed_length = at91_aes_roundup(data_length);
 		cmac = (const unsigned int *)((char *)data + fixed_length);
-		if (memcmp(cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE))
+		if (!consttime_memequal(cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE))
 			goto exit;
 	}
 
 	/* Decrypt the whole file */
 	if (at91_aes_cbc(data_length, data, data, 0,

Vulnerable code: 		if (memcmp(cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE))
Fixed code: 		if (!consttime_memequal(cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE))
CVE-2017-10965: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 9.8
Published: 2017-07-07T14:29Z
Repository: https://github.com/irssi/irssi
Language: Unknown
Commit date: 2017-07-05 14:47:30 +0000
Commit message: Merge branch 'security' into 'master'

Security

Closes #10

See merge request !17
CVE-2017-10966: Use After Free (CWE-416)
value: An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2017-07-07T14:29Z
Repository: https://github.com/irssi/irssi
Language: Unknown
Commit date: 2017-07-05 14:47:30 +0000
Commit message: Merge branch 'security' into 'master'

Security

Closes #10

See merge request !17
CVE-2017-7191: Use After Free (CWE-416)
value: The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2017-03-27T17:59Z
Repository: https://github.com/irssi/irssi
Language: Unknown
Commit date: 2017-03-10 17:18:18 +0100
Commit message: Merge branch 'netjoin-timeout' into 'master'

fe-netjoin: remove irc servers on "server disconnected" signal

Closes #7

See merge request !10
CVE-2019-13045: Use After Free (CWE-416)
value: Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 8.1
Published: 2019-06-29T14:15Z
Repository: https://github.com/irssi/irssi
Language: Unknown
Commit date: 2019-06-28 11:28:30 +0200
Commit message: Merge pull request #1058 from ailin-nemui/sasl-reconnect

copy sasl username and password values
CVE-2020-21572: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, allows attackers to cause a denial of service.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2021-11-02T18:15Z
Repository: https://github.com/trgil/gilcc
Language: C
Files changed: src/src_parser.c
Commit date: 2019-12-22 13:47:09 -0800
Commit message: Fix parser tmp-buffer overflow issue

Diff: diff --git a/src/src_parser.c b/src/src_parser.c
index 321c336..262ae5d 100644
--- a/src/src_parser.c
+++ b/src/src_parser.c
@@ -169,25 +169,27 @@ static int src_parser_trans_stage_1_2_3(const int tmp_fd, const char *src, const
                 case '\n':
                     if (pbuf.tmp_indx &&
                             (PBUF_TMP_PREV_CHAR(pbuf) == ' ' || PBUF_TMP_PREV_CHAR(pbuf) == '\t' ||
                              PBUF_TMP_PREV_CHAR(pbuf) == '\n')) {
                         pbuf.f_indx++;
-                    } else if (pbuf.tmp_indx && 
+                    } else if (pbuf.tmp_indx &&
                             (PBUF_TMP_PREV_CHAR(pbuf) == '\\')) {
                         pbuf.tmp_indx--;
                         pbuf.f_indx++;
                     } else {
                         p_buf_push_tmp_char(&pbuf, '\n');
                     }
 
                     continue;
 
                 case '\\':
+                    p_buf_write_tmp(&pbuf, tmp_fd);
                     p_buf_push_tmp_char(&pbuf, '\\');
                     continue;
 
                 case '/':
+                    p_buf_write_tmp(&pbuf, tmp_fd);
                     p_buf_push_tmp_char(&pbuf, '/');
                     continue;
 
                 case '*':
                     if (pbuf.tmp_indx &&

Vulnerable code:                     } else if (pbuf.tmp_indx && 
Fixed code:                     } else if (pbuf.tmp_indx &&
                    p_buf_write_tmp(&pbuf, tmp_fd);
                    p_buf_write_tmp(&pbuf, tmp_fd);
CVE-2024-27093: Insufficient Information (NVD-CWE-noinfo)
value: Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database).  When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result.  Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully.  Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability.  This vulnerability is patched in version 0.20240226.1425+ref.53868a8.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-26T22:15Z
Repository: https://github.com/stacklok/minder
Language: Go
Files changed: internal/controlplane/handlers_githubwebhooks.go
Commit date: 2024-02-26 09:47:57 -0800
Commit message: Fix client crash with fix for GHSA-q6h8-4j2v-pjg4 (#2432)


Diff: diff --git a/internal/controlplane/handlers_githubwebhooks.go b/internal/controlplane/handlers_githubwebhooks.go
index cbe32cec..bf8c8a8e 100644
--- a/internal/controlplane/handlers_githubwebhooks.go
+++ b/internal/controlplane/handlers_githubwebhooks.go
@@ -234,10 +234,16 @@ func (s *Server) registerWebhookForRepository(
 	url := s.cfg.WebhookConfig.ExternalWebhookURL
 	ping := s.cfg.WebhookConfig.ExternalPingURL
 	secret := s.cfg.WebhookConfig.WebhookSecret
 
 	regResult := &pb.RegisterRepoResult{
+		// We will overwrite this later when we've looked it up from the provider,
+		// but existing clients expect a message here, so let's add one.
+		Repository: &pb.Repository{
+			Name:  repo.Name,  // Not normalized, from client
+			Owner: repo.Owner, // Not normalized, from client
+		},
 		Status: &pb.RegisterRepoResult_Status{
 			Success: false,
 		},
 	}
 

Fixed code: 		// We will overwrite this later when we've looked it up from the provider,
		// but existing clients expect a message here, so let's add one.
		Repository: &pb.Repository{
			Name:  repo.Name,  // Not normalized, from client
			Owner: repo.Owner, // Not normalized, from client
		},
CVE-2020-36420: Reachable Assertion (CWE-617)
value: Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a malformed Range header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 7.5
Published: 2021-07-15T00:15Z
Repository: https://github.com/jech/polipo
Language: Other
Files changed: README
Commit date: 2016-11-06 19:34:34 +0100
Commit message: Rephrase README.

Diff: diff --git a/README b/README
index 33d803d..3c61ff9 100644
--- a/README
+++ b/README
@@ -1,13 +1,9 @@
-Polipo is obsolete
-==================
+Polipo is no longer maintained
+==============================
 
-When it was first written, Polipo was probably the best HTTP proxy
-available.  Since then, the web protocols have changed, and Polipo hasn't
-kept up -- it has no support for HTTP/2.0 or the WebSocket protocol.
-
-Polipo will no longer be maintained.
+Polipo is no longer maintained.  Sorry.
 
 
 Original Polipo README
 ======================
 

Vulnerable code: Polipo is obsolete
==================
When it was first written, Polipo was probably the best HTTP proxy
available.  Since then, the web protocols have changed, and Polipo hasn't
kept up -- it has no support for HTTP/2.0 or the WebSocket protocol.

Polipo will no longer be maintained.
Fixed code: Polipo is no longer maintained
==============================
Polipo is no longer maintained.  Sorry.
CVE-2019-12395: Improper Authentication (CWE-287)
value: In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if victim enables login-required in setting.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 5.3
Published: 2019-05-28T13:29Z
Repository: https://github.com/webbukkit/dynmap
Language: Unknown
Commit date: 2019-05-04 11:28:31 -0500
Commit message: Merge pull request #2475 from Ry0taK/v3.0

Fix required login bypass vulnerability
CVE-2020-11075: Other (NVD-CWE-Other)
value: In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a valid API request to anchore engine, or if an already added image that anchore is monitoring has its manifest altered to exploit the same flaw. A successful attack can be used to execute commands that run in the analyzer environment, with the same permissions as the user that anchore engine is run as - including access to the credentials that Engine uses to access its own database which have read-write ability, as well as access to the running engien analyzer service environment. By default Anchore Engine is released and deployed as a container where the user is non-root, but if users run Engine directly or explicitly set the user to 'root' then that level of access may be gained in the execution environment where Engine runs. This issue is fixed in version 0.7.1.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.9
Published: 2020-05-27T22:15Z
Repository: https://github.com/anchore/anchore-engine
Language: Unknown
Commit date: 2020-04-22 15:54:55 -0700
Commit message: Merge pull request #431 from anchore/dev/nurmi/osoverride_skopeo_update

Ensure only supported os overrides are used in skopeo download comman…
CVE-2022-31549: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The olmax99/helm-flask-celery repository before 2022-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.3
Published: 2022-07-11T01:15Z
Repository: https://github.com/olmax99/helm-flask-celery
Language: Unknown
Commit date: 2022-05-25 22:04:09 +0200
Commit message: Merge pull request #2 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability
CVE-2020-36617: Use of Uninitialized Resource (CWE-908)
value: A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability is still doubted at the moment. The name of the patch is bf4032f34832ee11d79aa60a226cc018e7ec5eed. It is recommended to apply a patch to fix this issue. The identifier VDB-216205 was assigned to this vulnerability. NOTE: In some deployment models this would be a vulnerability. README specifically warns about avoiding such deployment models.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 9.8
Published: 2022-12-18T15:15Z
Repository: https://github.com/ewxrjk/sftpserver
Language: C
Files changed: parse.c
Commit date: 2020-08-29 08:52:30 +0100
Commit message: Fix handle mis-parse

This could lead to the server process
accessing uninitialized data.

In some deployment models this would
be a vulnerability. However, the README
specifically warns about avoiding such
deployment models, so this patch is not
going to be treated as a vulnerability fix.

Diff: diff --git a/parse.c b/parse.c
index db9210e..b7b3323 100644
--- a/parse.c
+++ b/parse.c
@@ -95,12 +95,15 @@ uint32_t sftp_parse_path(struct sftpjob *job, char **strp) {
 }
 
 uint32_t sftp_parse_handle(struct sftpjob *job, struct handleid *id) {
   uint32_t len, rc;
 
-  if((rc = sftp_parse_uint32(job, &len)) != SSH_FX_OK || len != 8 ||
-     (rc = sftp_parse_uint32(job, &id->id)) != SSH_FX_OK ||
+  if((rc = sftp_parse_uint32(job, &len)) != SSH_FX_OK)
+    return rc;
+  if(len != 8)
+    return SSH_FX_BAD_MESSAGE;
+  if((rc = sftp_parse_uint32(job, &id->id)) != SSH_FX_OK ||
      (rc = sftp_parse_uint32(job, &id->tag) != SSH_FX_OK))
     return rc;
   return SSH_FX_OK;
 }
 

Vulnerable code:   if((rc = sftp_parse_uint32(job, &len)) != SSH_FX_OK || len != 8 ||
     (rc = sftp_parse_uint32(job, &id->id)) != SSH_FX_OK ||
Fixed code:   if((rc = sftp_parse_uint32(job, &len)) != SSH_FX_OK)
    return rc;
  if(len != 8)
    return SSH_FX_BAD_MESSAGE;
  if((rc = sftp_parse_uint32(job, &id->id)) != SSH_FX_OK ||
CVE-2021-41189: Incorrect Authorization (CWE-863)
value: DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a workaround, users of 7.0 may temporarily disable the ability for community or collection administrators to manage permissions or workflows settings.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 7.2
Published: 2021-10-29T18:15Z
Repository: https://github.com/DSpace/DSpace
Language: Unknown
Commit date: 2021-10-26 11:31:42 -0500
Commit message: Merge pull request from GHSA-cf2j-vf36-c6w8

Default groups issue
CVE-2024-38364: Insufficient Information (NVD-CWE-noinfo)
value: DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-26T00:15Z
Repository: https://github.com/DSpace/DSpace
Language: Unknown
Commit date: 2024-06-17 09:22:56 +0200
Commit message: Merge pull request #9638 from tdonohue/avoid_inline_js

Update configuration to always download HTML/JS/XML Bitstreams (no inline display)
CVE-2022-25865: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 9.8
Published: 2022-05-13T20:15Z
Repository: https://github.com/microsoft/workspace-tools
Language: JSON
Files changed: change/workspace-tools-01b53966-7f59-4ab9-abd7-ac355a7ae3b1.json, src/git.ts
Commit date: 2022-04-20 09:47:57 -0700
Commit message: Fix git fetch - addresses a potential security concern regarding git fetch (#103)

* fixes a potential security issue where fetch --upload-pack can allow for command injection

* Change files
Diff: diff --git a/change/workspace-tools-01b53966-7f59-4ab9-abd7-ac355a7ae3b1.json b/change/workspace-tools-01b53966-7f59-4ab9-abd7-ac355a7ae3b1.json
new file mode 100644
index 0000000..ed8c5d8
--- /dev/null
+++ b/change/workspace-tools-01b53966-7f59-4ab9-abd7-ac355a7ae3b1.json
@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "fixes a potential security issue where fetch --upload-pack can allow for command injection",
+  "packageName": "workspace-tools",
+  "email": "kchau@microsoft.com",
+  "dependentChangeType": "patch"
+}
diff --git a/src/git.ts b/src/git.ts
index 19339ef..9daeb7f 100644
--- a/src/git.ts
+++ b/src/git.ts
@@ -116,19 +116,19 @@ export function getUntrackedChanges(cwd: string) {
     throw gitError(`Cannot gather information about untracked changes`, e);
   }
 }
 
 export function fetchRemote(remote: string, cwd: string) {
-  const results = git(["fetch", remote], { cwd });
+  const results = git(["fetch", "--", remote], { cwd });
 
   if (!results.success) {
     throw gitError(`Cannot fetch remote: ${remote}`);
   }
 }
 
 export function fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) {
-  const results = git(["fetch", remote, remoteBranch], { cwd });
+  const results = git(["fetch", "--", remote, remoteBranch], { cwd });
 
   if (!results.success) {
     throw gitError(`Cannot fetch remote: ${remote} ${remoteBranch}`);
   }
 }

Vulnerable code:   const results = git(["fetch", remote], { cwd });
  const results = git(["fetch", remote, remoteBranch], { cwd });
Fixed code: {
  "type": "patch",
  "comment": "fixes a potential security issue where fetch --upload-pack can allow for command injection",
  "packageName": "workspace-tools",
  "email": "kchau@microsoft.com",
  "dependentChangeType": "patch"
}
  const results = git(["fetch", "--", remote], { cwd });
  const results = git(["fetch", "--", remote, remoteBranch], { cwd });
CVE-2019-13173: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.5
Published: 2019-07-02T20:15Z
Repository: https://github.com/npm/fstream
Language: JavaScript
Files changed: lib/writer.js
Commit date: 2019-05-14 17:37:57 -0700
Commit message: Clobber a Link if it's in the way of a File

Fixes https://github.com/npm/node-tar/issues/212

Diff: diff --git a/lib/writer.js b/lib/writer.js
index 140e449..3f10547 100644
--- a/lib/writer.js
+++ b/lib/writer.js
@@ -145,11 +145,11 @@ Writer.prototype._stat = function (current) {
     self._old = current
     var currentType = getType(current)
 
     // if it's a type change, then we need to clobber or error.
     // if it's not a type change, then let the impl take care of it.
-    if (currentType !== self.type) {
+    if (currentType !== self.type || self.type === 'File' && current.nlink > 1) {
       return rimraf(self._path, function (er) {
         if (er) return self.error(er)
         self._old = null
         create(self)
       })

Vulnerable code:     if (currentType !== self.type) {
Fixed code:     if (currentType !== self.type || self.type === 'File' && current.nlink > 1) {
CVE-2022-29215: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a workaround, restrict operator permissions to untrusted people and avoid entering arguments likely to cause a crash.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 7.5
Published: 2022-05-21T00:15Z
Repository: https://github.com/kaidomc-pm-pl/RegionProtect
Language: PHP
Files changed: src/kaidoMC/RegionProtect/RegionProtect.php
Commit date: 2022-05-11 13:02:03 +0700
Commit message: Patch the hole

Thanks to @SOF3 for finding this vulnerability!

Co-Authored-By: Jonathan Chan Kwan Yin <sofe2038@gmail.com>

Diff: diff --git a/src/kaidoMC/RegionProtect/RegionProtect.php b/src/kaidoMC/RegionProtect/RegionProtect.php
index 14b5857..ddb3248 100644
--- a/src/kaidoMC/RegionProtect/RegionProtect.php
+++ b/src/kaidoMC/RegionProtect/RegionProtect.php
@@ -120,10 +120,14 @@ class RegionProtect extends PluginBase {
 
 		$form = new CustomForm(function (Player $sender, ?array $result) use ($X1, $X2, $Y1, $Y2, $Z1, $Z2): void {
 			if ($result === null) {
 				return;
 			}
+			if (!preg_match('/^[\w]+$/', $result[2])) {
+				$sender->sendMessage(TextFormat::RED . "Invalid region name! Only alphanumeric characters allowed.");
+				return;
+			}
 			if ($result[2] != null and $result[3] != null) {
 				$this->getVectorAdjust()->setLocation($sender, $result[2], $result[3], [$X1, $Y1, $Z1], [$X2, $Y2, $Z2]);
 			} else {
 				$sender->sendMessage(TextFormat::RED . "Invalid information, please try again!");
 			}

Fixed code: 			if (!preg_match('/^[\w]+$/', $result[2])) {
				$sender->sendMessage(TextFormat::RED . "Invalid region name! Only alphanumeric characters allowed.");
				return;
			}
CVE-2020-8981: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-02-13T17:15Z
Repository: https://github.com/mantisbt-plugins/source-integration
Language: PHP
Files changed: Source/pages/repo_delete.php
Commit date: 2020-02-13 14:36:11 +0100
Commit message: Fix XSS in Delete Repository page

Fixes #338

Diff: diff --git a/Source/pages/repo_delete.php b/Source/pages/repo_delete.php
index 64b1b8e..c52ff8c 100644
--- a/Source/pages/repo_delete.php
+++ b/Source/pages/repo_delete.php
@@ -8,11 +8,12 @@ access_ensure_global_level( plugin_config_get( 'manage_threshold' ) );
 
 $f_repo_id = gpc_get_string( 'id' );
 
 $t_repo = SourceRepo::load( $f_repo_id );
 
-helper_ensure_confirmed( sprintf( plugin_lang_get( 'ensure_delete' ), $t_repo->name ), plugin_lang_get( 'delete_repository' ) );
+$t_message = sprintf( plugin_lang_get( 'ensure_delete' ), string_attribute( $t_repo->name ) );
+helper_ensure_confirmed( $t_message, plugin_lang_get( 'delete_repository' ) );
 
 SourceRepo::delete( $t_repo->id );
 
 form_security_purge( 'plugin_Source_repo_delete' );
 print_successful_redirect( plugin_page( 'index', true ) );

Vulnerable code: helper_ensure_confirmed( sprintf( plugin_lang_get( 'ensure_delete' ), $t_repo->name ), plugin_lang_get( 'delete_repository' ) );
Fixed code: $t_message = sprintf( plugin_lang_get( 'ensure_delete' ), string_attribute( $t_repo->name ) );
helper_ensure_confirmed( $t_message, plugin_lang_get( 'delete_repository' ) );
CVE-2021-3645: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-09-10T11:15Z
Repository: https://github.com/viking04/merge
Language: JavaScript
Files changed: index.js, package-lock.json, test/test.js
Commit date: 2021-09-08 19:02:30 +0530
Commit message: Fix for Prototype Pollution

Diff: diff --git a/index.js b/index.js
index c2adffb..d60835c 100644
--- a/index.js
+++ b/index.js
@@ -1,8 +1,10 @@
 function merge(dst, ...sources) {
     for (src of sources) {
       for (let key in src) {
+        //fix for prototype pollution
+        if (key === "__proto__" || key === "constructor") continue;
         let s = src[key], d = dst[key]
         if (Object(s) == s && Object(d) === d) {
           dst[key] = merge(d, s)
           continue
         }
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..5349986
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,13 @@
+{
+  "name": "@viking04/merge",
+  "version": "1.0.1",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@viking04/merge",
+      "version": "1.0.1",
+      "license": "MIT"
+    }
+  }
+}
diff --git a/test/test.js b/test/test.js
index 1bd96ba..20fbb9c 100644
--- a/test/test.js
+++ b/test/test.js
@@ -1,6 +1,11 @@
 var merge = require("..")
 var a = {"a":{"red":"apple"}}
 var b = {"b":{"yellow":"mango"}}
 var c = {"a":{"orange":"orange"}}
 merge(a,b,c)
-console.log(a)
\ No newline at end of file
+console.log(a)
+
+//Test case for prototype pollution fix
+var prototype_pollution_test = JSON.parse('{"__proto__":{"polluted":true}}')
+merge(a,prototype_pollution_test)
+console.log({}.polluted)

Vulnerable code: console.log(a)
Fixed code:         //fix for prototype pollution
        if (key === "__proto__" || key === "constructor") continue;
{
  "name": "@viking04/merge",
  "version": "1.0.1",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "@viking04/merge",
      "version": "1.0.1",
      "license": "MIT"
    }
  }
}
console.log(a)

//Test case for prototype pollution fix
var prototype_pollution_test = JSON.parse('{"__proto__":{"polluted":true}}')
merge(a,prototype_pollution_test)
console.log({}.polluted)
CVE-2023-47625: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParser_TryParseCrsfPacket function in /src/drivers/rc/crsf_rc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the _rcs_buf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 4.3
Published: 2023-11-13T21:15Z
Repository: https://github.com/PX4/PX4-Autopilot
Language: C++
Files changed: src/drivers/rc/crsf_rc/CrsfParser.cpp
Commit date: 2023-10-05 08:00:22 +0200
Commit message: fix crsf_rc: prevent potential buffer overflow for unknown packets

The length check for unknown packets did not include PACKET_SIZE_TYPE_SIZE
and CRC_SIZE, and hence working_index could overflow CRSF_MAX_PACKET_LEN,
triggering invalid memory access further down in QueueBuffer_PeekBuffer.

Also the working_segment_size was wrong for unknown packets.

Credits for finding this go to @Pwn9uin.

Diff: diff --git a/src/drivers/rc/crsf_rc/CrsfParser.cpp b/src/drivers/rc/crsf_rc/CrsfParser.cpp
index ba0ddac233..aa499db9f5 100644
--- a/src/drivers/rc/crsf_rc/CrsfParser.cpp
+++ b/src/drivers/rc/crsf_rc/CrsfParser.cpp
@@ -291,13 +291,13 @@ bool CrsfParser_TryParseCrsfPacket(CrsfPacket_t *const new_packet, CrsfParserSta
 				working_segment_size = working_descriptor->packet_size;
 
 			} else {
 				// We don't know what this packet is, so we'll let the parser continue
 				// just so that we can dequeue it in one shot
-				working_segment_size = packet_size + PACKET_SIZE_TYPE_SIZE;
+				working_segment_size = packet_size - PACKET_SIZE_TYPE_SIZE;
 
-				if (working_segment_size > CRSF_MAX_PACKET_LEN) {
+				if (working_index + working_segment_size + CRC_SIZE > CRSF_MAX_PACKET_LEN) {
 					parser_statistics->invalid_unknown_packet_sizes++;
 					parser_state = PARSER_STATE_HEADER;
 					working_segment_size = HEADER_SIZE;
 					working_index = 0;
 					buffer_count = QueueBuffer_Count(&rx_queue);

Vulnerable code: 				working_segment_size = packet_size + PACKET_SIZE_TYPE_SIZE;
				if (working_segment_size > CRSF_MAX_PACKET_LEN) {
Fixed code: 				working_segment_size = packet_size - PACKET_SIZE_TYPE_SIZE;
				if (working_index + working_segment_size + CRC_SIZE > CRSF_MAX_PACKET_LEN) {
CVE-2016-5350: Resource Management Errors (CWE-399)
value: epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles unexpected offsets, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CWE description: Weaknesses in this category are related to improper management of system resources.
CVSS v3 base score: 7.5
Published: 2016-08-07T16:59Z
Repository: https://github.com/wireshark/wireshark
Language: C
Files changed: epan/dissectors/packet-dcerpc-spoolss.c
Commit date: 2016-03-30 18:17:07 +0000
Commit message: SPOOLSS: Try to avoid an infinite loop.

Use tvb_reported_length_remaining in dissect_spoolss_uint16uni. Make
sure our offset always increments in dissect_spoolss_keybuffer.

Change-Id: I7017c9685bb2fa27161d80a03b8fca4ef630e793
Reviewed-on: https://code.wireshark.org/review/14687
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

Diff: diff --git a/epan/dissectors/packet-dcerpc-spoolss.c b/epan/dissectors/packet-dcerpc-spoolss.c
index 8774e3416a..22eef3c5ad 100644
--- a/epan/dissectors/packet-dcerpc-spoolss.c
+++ b/epan/dissectors/packet-dcerpc-spoolss.c
@@ -1088,11 +1088,11 @@ dissect_spoolss_uint16uni(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
 	if (offset % 2)
 		offset += 2 - (offset % 2);
 
 	/* Get remaining data in buffer as a string */
 
-	remaining = tvb_captured_length_remaining(tvb, offset);
+	remaining = tvb_reported_length_remaining(tvb, offset);
 	if (remaining <= 0) {
 		if (data)
 			*data = g_strdup("");
 		return offset;
 	}
@@ -6196,13 +6196,14 @@ dissect_spoolss_keybuffer(tvbuff_t *tvb, int offset, packet_info *pinfo,
 		 * size is almost certainly too big).
 		 */
 		end_offset = tvb_reported_length_remaining(tvb, offset) + 1;
 	}
 
-	while (offset < end_offset)
+	while (offset > 0 && offset < end_offset) {
 		offset = dissect_spoolss_uint16uni(
 			tvb, offset, pinfo, tree, drep, NULL, hf_keybuffer);
+	}
 
 	return offset;
 }
 
 

Vulnerable code: 	remaining = tvb_captured_length_remaining(tvb, offset);
	while (offset < end_offset)
Fixed code: 	remaining = tvb_reported_length_remaining(tvb, offset);
	while (offset > 0 && offset < end_offset) {
	}
CVE-2016-5351: Improper Input Validation (CWE-20)
value: epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the lack of an EAPOL_RSN_KEY, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.9
Published: 2016-08-07T16:59Z
Repository: https://github.com/wireshark/wireshark
Language: C
Files changed: epan/crypt/airpdcap.c
Commit date: 2016-05-23 08:04:46 +0000
Commit message: Make sure EAPOL body is big enough for a EAPOL_RSN_KEY.

A pointer to a EAPOL_RSN_KEY is set on the packet presuming the
whole EAPOL_RSN_KEY is there.  That's not always the case for
fuzzed/malicious captures.

Bug: 11585
Change-Id: Ib94b8aceef444c7820e43b969596efdb8dbecccd
Reviewed-on: https://code.wireshark.org/review/15540
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

Diff: diff --git a/epan/crypt/airpdcap.c b/epan/crypt/airpdcap.c
index dd948a0d1d..1212cdde7c 100644
--- a/epan/crypt/airpdcap.c
+++ b/epan/crypt/airpdcap.c
@@ -569,11 +569,11 @@ static INT AirPDcapScanForKeys(
             return AIRPDCAP_RET_NO_VALID_HANDSHAKE;
         }
 
         /* get and check the body length (IEEE 802.1X-2004, pg. 25) */
         bodyLength=pntoh16(data+offset+2);
-        if ((tot_len-offset-4) < bodyLength) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */
+        if (((tot_len-offset-4) < bodyLength) || (bodyLength < sizeof(EAPOL_RSN_KEY))) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */
             AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapScanForKeys", "EAPOL body too short", AIRPDCAP_DEBUG_LEVEL_3);
             return AIRPDCAP_RET_NO_VALID_HANDSHAKE;
         }
 
         /* skip EAPOL MPDU and go to the first byte of the body */

Vulnerable code:         if ((tot_len-offset-4) < bodyLength) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */
Fixed code:         if (((tot_len-offset-4) < bodyLength) || (bodyLength < sizeof(EAPOL_RSN_KEY))) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */
CVE-2016-5352: Out-of-bounds Read (CWE-125)
value: epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.9
Published: 2016-08-07T16:59Z
Repository: https://github.com/wireshark/wireshark
Language: C
Files changed: epan/crypt/airpdcap.c
Commit date: 2016-05-10 15:20:49 +0000
Commit message: Sanity check eapol_len in AirPDcapDecryptWPABroadcastKey

Bug: 12175
Change-Id: Iaf977ba48f8668bf8095800a115ff9a3472dd893
Reviewed-on: https://code.wireshark.org/review/15326
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Peter Wu <peter@lekensteyn.nl>

Diff: diff --git a/epan/crypt/airpdcap.c b/epan/crypt/airpdcap.c
index bb4d7bc43d..dd948a0d1d 100644
--- a/epan/crypt/airpdcap.c
+++ b/epan/crypt/airpdcap.c
@@ -349,11 +349,13 @@ AirPDcapDecryptWPABroadcastKey(const EAPOL_RSN_KEY *pEAPKey, guint8 *decryption_
         if (key_bytes_len < 16) {
             return AIRPDCAP_RET_NO_VALID_HANDSHAKE;
         }
     }
 
-    if (key_bytes_len < GROUP_KEY_MIN_LEN || key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY)) {
+    if ((key_bytes_len < GROUP_KEY_MIN_LEN) ||
+        (eapol_len < sizeof(EAPOL_RSN_KEY)) ||
+        (key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY))) {
         return AIRPDCAP_RET_NO_VALID_HANDSHAKE;
     }
 
     /* Encrypted key is in the information element field of the EAPOL key packet */
     key_data = (guint8 *)pEAPKey + sizeof(EAPOL_RSN_KEY);

Vulnerable code:     if (key_bytes_len < GROUP_KEY_MIN_LEN || key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY)) {
Fixed code:     if ((key_bytes_len < GROUP_KEY_MIN_LEN) ||
        (eapol_len < sizeof(EAPOL_RSN_KEY)) ||
        (key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY))) {
CVE-2016-10140: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2017-01-13T09:59Z
Repository: https://github.com/ZoneMinder/ZoneMinder
Language: Unknown
Commit date: 2016-11-22 12:33:55 -0600
Commit message: Merge pull request #1697 from connortechnology/apache_indexes

Apache indexes