Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-40704: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A XSS vulnerability was found in phoromatic_r_add_test_details.php in phoronix-test-suite.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-17T19:15Z
Repository: https://github.com/phoronix-test-suite/phoronix-test-suite
Language: PHP
Files changed: pts-core/phoromatic/phoromatic_functions.php
Commit date: 2022-07-23 07:32:43 -0500
Commit message: phoromatic: Explicitly check both $_GET abd $_POST in phoromatic_quit_if_invalid_input_found()

Fixes: https://github.com/phoronix-test-suite/phoronix-test-suite/issues/650#issuecomment-1193116678

Diff: diff --git a/pts-core/phoromatic/phoromatic_functions.php b/pts-core/phoromatic/phoromatic_functions.php
index 74ccc5444c..c2313dcdea 100644
--- a/pts-core/phoromatic/phoromatic_functions.php
+++ b/pts-core/phoromatic/phoromatic_functions.php
@@ -35,13 +35,24 @@ function phoromatic_quit_if_invalid_input_found($input_keys = null)
 
 	foreach(pts_strings::safety_strings_to_reject() as $invalid_string)
 	{
 		foreach($input_keys as $key)
 		{
-			if(isset($_REQUEST[$key]) && !empty($_REQUEST[$key]))
+			if(isset($_GET[$key]) && !empty($_GET[$key]))
 			{
-				foreach(pts_arrays::to_array($_REQUEST[$key]) as $val_to_check)
+				foreach(pts_arrays::to_array($_GET[$key]) as $val_to_check)
+				{
+					if(stripos($val_to_check, $invalid_string) !== false)
+					{
+						echo '<strong>Exited due to invalid input ( ' . $invalid_string . ') attempted:</strong> ' . htmlspecialchars($val_to_check);
+						exit;
+					}
+				}
+			}
+			if(isset($_POST[$key]) && !empty($_POST[$key]))
+			{
+				foreach(pts_arrays::to_array($_POST[$key]) as $val_to_check)
 				{
 					if(stripos($val_to_check, $invalid_string) !== false)
 					{
 						echo '<strong>Exited due to invalid input ( ' . $invalid_string . ') attempted:</strong> ' . htmlspecialchars($val_to_check);
 						exit;

Vulnerable code: 			if(isset($_REQUEST[$key]) && !empty($_REQUEST[$key]))
				foreach(pts_arrays::to_array($_REQUEST[$key]) as $val_to_check)
Fixed code: 			if(isset($_GET[$key]) && !empty($_GET[$key]))
				foreach(pts_arrays::to_array($_GET[$key]) as $val_to_check)
				{
					if(stripos($val_to_check, $invalid_string) !== false)
					{
						echo '<strong>Exited due to invalid input ( ' . $invalid_string . ') attempted:</strong> ' . htmlspecialchars($val_to_check);
						exit;
					}
				}
			}
			if(isset($_POST[$key]) && !empty($_POST[$key]))
			{
				foreach(pts_arrays::to_array($_POST[$key]) as $val_to_check)
CVE-2020-5292: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and administrators' password hashes, modify data, or drop tables. The unescaped parameter is "searchUsers" when sending a POST request to "/tickets/showKanban" with a valid session. In the code, the parameter is named "users" in class.tickets.php. This issue is fixed in versions 2.0.15 and 2.1.0 beta 3.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2020-03-31T19:15Z
Repository: https://github.com/Leantime/leantime
Language: Unknown
Commit date: 2020-03-26 21:39:55 -0700
Commit message: Merge pull request #181 from Leantime/issue179-sql-bind-injection

fix: use PDO injection for IN clause for tickets query for users filter
CVE-2023-45826: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 6.5
Published: 2023-10-19T19:15Z
Repository: https://github.com/Leantime/leantime
Language: Unknown
Commit date: 2023-09-25 14:38:45 -0400
Commit message: Merge pull request #1906 from Leantime/bugFixes

Bug fixes
CVE-2020-5294: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-04-16T22:15Z
Repository: https://github.com/PrestaShop/ps_socialfollow
Language: Unknown
Commit date: 2020-04-15 17:01:19 +0200
Commit message: Merge pull request from GHSA-774w-fg8p-7c8w

Check if fields are URL
CVE-2021-23369: Insufficient Information (NVD-CWE-noinfo)
value: The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-04-12T14:15Z
Repository: https://github.com/handlebars-lang/handlebars.js
Language: JavaScript
Files changed: lib/handlebars/runtime.js, spec/security.js
Commit date: 2021-02-13 13:41:40 +0100
Commit message: fix: check prototype property access in strict-mode (#1736)

Diff: diff --git a/lib/handlebars/runtime.js b/lib/handlebars/runtime.js
index 67a500d7..36bf6c94 100644
--- a/lib/handlebars/runtime.js
+++ b/lib/handlebars/runtime.js
@@ -122,11 +122,11 @@ export function template(templateSpec, env) {
       if (!obj || !(name in obj)) {
         throw new Exception('"' + name + '" not defined in ' + obj, {
           loc: loc
         });
       }
-      return obj[name];
+      return container.lookupProperty(obj, name);
     },
     lookupProperty: function(parent, propertyName) {
       let result = parent[propertyName];
       if (result == null) {
         return result;
diff --git a/spec/security.js b/spec/security.js
index 2bc66f71..00eb1318 100644
--- a/spec/security.js
+++ b/spec/security.js
@@ -296,10 +296,14 @@ describe('security issues', function() {
 
       describe('in compat-mode', function() {
         checkProtoPropertyAccess({ compat: true });
       });
 
+      describe('in strict-mode', function() {
+        checkProtoPropertyAccess({ strict: true });
+      });
+
       function checkProtoPropertyAccess(compileOptions) {
         it('should be prohibited by default and log a warning', function() {
           var spy = sinon.spy(console, 'error');
 
           expectTemplate('{{aProperty}}')

Vulnerable code:       return obj[name];
Fixed code:       return container.lookupProperty(obj, name);
      describe('in strict-mode', function() {
        checkProtoPropertyAccess({ strict: true });
      });
CVE-2022-0084: Allocation of Resources Without Limits or Throttling (CWE-770)
value: A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2022-08-26T18:15Z
Repository: https://github.com/xnio/xnio
Language: Unknown
Commit date: 2022-07-08 06:36:27 -0500
Commit message: Merge pull request #291 from OrangeDog/patch-1
CVE-2019-10911: Improper Authentication (CWE-287)
value: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2019-05-16T22:29Z
Repository: https://github.com/symfony/symfony
Language: PHP
Files changed: src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php
Commit date: 2019-04-06 21:17:28 +0200
Commit message: [Security] Add a separator in the remember me cookie hash

Diff: diff --git a/src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php b/src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php
index 48d88e5730b..95221133393 100644
--- a/src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php
+++ b/src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php
@@ -118,8 +118,8 @@ class TokenBasedRememberMeServices extends AbstractRememberMeServices
      *
      * @return string
      */
     protected function generateCookieHash($class, $username, $expires, $password)
     {
-        return hash_hmac('sha256', $class.$username.$expires.$password, $this->getSecret());
+        return hash_hmac('sha256', $class.self::COOKIE_DELIMITER.$username.self::COOKIE_DELIMITER.$expires.self::COOKIE_DELIMITER.$password, $this->getSecret());
     }
 }

Vulnerable code:         return hash_hmac('sha256', $class.$username.$expires.$password, $this->getSecret());
Fixed code:         return hash_hmac('sha256', $class.self::COOKIE_DELIMITER.$username.self::COOKIE_DELIMITER.$expires.self::COOKIE_DELIMITER.$password, $this->getSecret());
CVE-2020-15094: Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)
value: In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.
CWE description: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
CVSS v3 base score: 8.8
Published: 2020-09-02T18:15Z
Repository: https://github.com/symfony/symfony
Language: Unknown
Commit date: 2020-09-02 09:40:48 +0200
Commit message: security #cve-2020-15094 Remove headers with internal meaning from HttpClient responses (mpdude)

This PR was merged into the 4.4 branch.
CVE-2020-5255: Improper Input Validation (CWE-20)
value: In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response&#39;s content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 4.3
Published: 2020-03-30T20:15Z
Repository: https://github.com/symfony/symfony
Language: Unknown
Commit date: 2020-03-30 16:08:46 +0200
Commit message: security #cve-2020-5255 [HttpFoundation] Do not set the default Content-Type based on the Accept header (yceruto)

This PR was merged into the 4.4 branch.
CVE-2020-5275: Incorrect Authorization (CWE-863)
value: In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 8.1
Published: 2020-03-30T20:15Z
Repository: https://github.com/symfony/symfony
Language: Unknown
Commit date: 2020-03-30 13:55:16 +0200
Commit message: security #cve-2020-5275 [Security] Fix access_control behavior with unanimous decision strategy (chalasr)

This PR was merged into the 4.4 branch.
CVE-2021-21424: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2021-05-13T16:15Z
Repository: https://github.com/symfony/symfony
Language: Unknown
Commit date: 2021-05-12 14:32:10 +0200
Commit message: security #cve-2021-21424 [Security][Guard] Prevent user enumeration (chalasr)

This PR was merged into the 3.4 branch.
CVE-2023-46733: Session Fixation (CWE-384)
value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means of checking the user identifier. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations, which is not the case at the moment. As of versions 5.4.31 and 6.3.8, Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 6.5
Published: 2023-11-10T18:15Z
Repository: https://github.com/symfony/symfony
Language: Unknown
Commit date: 2023-11-09 19:15:13 +0100
Commit message: security #cve-2023-46733 [Security] Fix possible session fixation when only the *token* changes (RobertMe)

This PR was merged into the 5.4 branch.
CVE-2023-46734: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-11-10T18:15Z
Repository: https://github.com/symfony/symfony
Language: Unknown
Commit date: 2023-11-09 22:17:40 +0100
Commit message: security #cve-2023-46734 [TwigBridge] Ensure CodeExtension's filters properly escape their input (nicolas-grekas, GromNaN)

This PR was merged into the 4.4 branch.
CVE-2023-46735: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in its response.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-11-10T18:15Z
Repository: https://github.com/symfony/symfony
Language: PHP
Files changed: src/Symfony/Component/Webhook/Controller/WebhookController.php
Commit date: 2023-11-06 09:29:40 +0100
Commit message: [Webhook] Remove user-submitted type from HTTP response

Diff: diff --git a/src/Symfony/Component/Webhook/Controller/WebhookController.php b/src/Symfony/Component/Webhook/Controller/WebhookController.php
index a31e9a5d0856..af34e78389e6 100644
--- a/src/Symfony/Component/Webhook/Controller/WebhookController.php
+++ b/src/Symfony/Component/Webhook/Controller/WebhookController.php
@@ -36,11 +36,11 @@ final class WebhookController
     }
 
     public function handle(string $type, Request $request): Response
     {
         if (!isset($this->parsers[$type])) {
-            return new Response(sprintf('No parser found for webhook of type "%s".', $type), 404);
+            return new Response('No webhook parser found for the type given in the URL.', 404, ['Content-Type' => 'text/plain']);
         }
         /** @var RequestParserInterface $parser */
         $parser = $this->parsers[$type]['parser'];
 
         if (!$event = $parser->parse($request, $this->parsers[$type]['secret'])) {

Vulnerable code:             return new Response(sprintf('No parser found for webhook of type "%s".', $type), 404);
Fixed code:             return new Response('No webhook parser found for the type given in the URL.', 404, ['Content-Type' => 'text/plain']);
CVE-2023-34094: Missing Authentication for Critical Function (CWE-306)
value: ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized access to the config.json file of the privately deployed ChuanghuChatGPT project, when authentication is not configured. The attacker can exploit this vulnerability to steal the API keys in the configuration file. The vulnerability has been fixed in commit bfac445. As a workaround, setting up access authentication can help mitigate the vulnerability.
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 5.3
Published: 2023-06-02T16:15Z
Repository: https://github.com/GaiZhenbiao/ChuanhuChatGPT
Language: Python
Files changed: ChuanhuChatbot.py
Commit date: 2023-06-01 10:40:10 +0800
Commit message: 增加 blocked path

Diff: diff --git a/ChuanhuChatbot.py b/ChuanhuChatbot.py
index 3b16860..93fe22e 100644
--- a/ChuanhuChatbot.py
+++ b/ChuanhuChatbot.py
@@ -466,10 +466,11 @@ logging.info(
 demo.title = i18n("川虎Chat 🚀")
 
 if __name__ == "__main__":
     reload_javascript()
     demo.queue(concurrency_count=CONCURRENT_COUNT).launch(
+        blocked_paths=["config.json"],
         server_name=server_name,
         server_port=server_port,
         share=share,
         auth=auth_list if authflag else None,
         favicon_path="./assets/favicon.ico",

Fixed code:         blocked_paths=["config.json"],
CVE-2016-9842: Insufficient Information (NVD-CWE-noinfo)
value: The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2017-05-23T04:29Z
Repository: https://github.com/madler/zlib
Language: C
Files changed: inflate.c
Commit date: 2015-09-05 17:45:55 -0700
Commit message: Avoid shifts of negative values inflateMark().

The C standard says that bit shifts of negative integers is
undefined.  This casts to unsigned values to assure a known
result.

Diff: diff --git a/inflate.c b/inflate.c
index 2889e3a..a718416 100644
--- a/inflate.c
+++ b/inflate.c
@@ -1504,13 +1504,14 @@ int subvert;
 long ZEXPORT inflateMark(strm)
 z_streamp strm;
 {
     struct inflate_state FAR *state;
 
-    if (strm == Z_NULL || strm->state == Z_NULL) return -1L << 16;
+    if (strm == Z_NULL || strm->state == Z_NULL)
+        return (long)(((unsigned long)0 - 1) << 16);
     state = (struct inflate_state FAR *)strm->state;
-    return ((long)(state->back) << 16) +
+    return (long)(((unsigned long)((long)state->back)) << 16) +
         (state->mode == COPY ? state->length :
             (state->mode == MATCH ? state->was - state->length : 0));
 }
 
 unsigned long ZEXPORT inflateCodesUsed(strm)

Vulnerable code:     if (strm == Z_NULL || strm->state == Z_NULL) return -1L << 16;
    return ((long)(state->back) << 16) +
Fixed code:     if (strm == Z_NULL || strm->state == Z_NULL)
        return (long)(((unsigned long)0 - 1) << 16);
    return (long)(((unsigned long)((long)state->back)) << 16) +
CVE-2016-9843: Insufficient Information (NVD-CWE-noinfo)
value: The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2017-05-23T04:29Z
Repository: https://github.com/madler/zlib
Language: C
Files changed: crc32.c
Commit date: 2016-09-28 20:48:38 -0700
Commit message: Avoid pre-decrement of pointer in big-endian CRC calculation.

There was a small optimization for PowerPCs to pre-increment a
pointer when accessing a word, instead of post-incrementing. This
required prefacing the loop with a decrement of the pointer,
possibly pointing before the object passed. This is not compliant
with the C standard, for which decrementing a pointer before its
allocated memory is undefined. When tested on a modern PowerPC
with a modern compiler, the optimization no longer has any effect.
Due to all that, and per the recommendation of a security audit of
the zlib code by Trail of Bits and TrustInSoft, in support of the
Mozilla Foundation, this "optimization" was removed, in order to
avoid the possibility of undefined behavior.

Diff: diff --git a/crc32.c b/crc32.c
index 979a719..05733f4 100644
--- a/crc32.c
+++ b/crc32.c
@@ -276,11 +276,11 @@ local unsigned long crc32_little(crc, buf, len)
     c = ~c;
     return (unsigned long)c;
 }
 
 /* ========================================================================= */
-#define DOBIG4 c ^= *++buf4; \
+#define DOBIG4 c ^= *buf4++; \
         c = crc_table[4][c & 0xff] ^ crc_table[5][(c >> 8) & 0xff] ^ \
             crc_table[6][(c >> 16) & 0xff] ^ crc_table[7][c >> 24]
 #define DOBIG32 DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4
 
 /* ========================================================================= */
@@ -298,20 +298,18 @@ local unsigned long crc32_big(crc, buf, len)
         c = crc_table[4][(c >> 24) ^ *buf++] ^ (c << 8);
         len--;
     }
 
     buf4 = (const z_crc_t FAR *)(const void FAR *)buf;
-    buf4--;
     while (len >= 32) {
         DOBIG32;
         len -= 32;
     }
     while (len >= 4) {
         DOBIG4;
         len -= 4;
     }
-    buf4++;
     buf = (const unsigned char FAR *)buf4;
 
     if (len) do {
         c = crc_table[4][(c >> 24) ^ *buf++] ^ (c << 8);
     } while (--len);

Vulnerable code: #define DOBIG4 c ^= *++buf4; \
    buf4--;
    buf4++;
Fixed code: #define DOBIG4 c ^= *buf4++; \
CVE-2022-37434: Out-of-bounds Write (CWE-787)
value: zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2022-08-05T07:15Z
Repository: https://github.com/madler/zlib
Language: C
Files changed: inflate.c
Commit date: 2022-07-30 15:58:02 -0700
Commit message: Fix a bug when getting a gzip header extra field with inflate().

If the extra field was larger than the space the user provided with
inflateGetHeader(), and if multiple calls of inflate() delivered
the extra header data, then there could be a buffer overflow of the
provided space. This commit assures that provided space is not
exceeded.

Diff: diff --git a/inflate.c b/inflate.c
index 7be8c636..7a728974 100644
--- a/inflate.c
+++ b/inflate.c
@@ -761,13 +761,14 @@ int flush;
         case EXTRA:
             if (state->flags & 0x0400) {
                 copy = state->length;
                 if (copy > have) copy = have;
                 if (copy) {
+                    len = state->head->extra_len - state->length;
                     if (state->head != Z_NULL &&
-                        state->head->extra != Z_NULL) {
-                        len = state->head->extra_len - state->length;
+                        state->head->extra != Z_NULL &&
+                        len < state->head->extra_max) {
                         zmemcpy(state->head->extra + len, next,
                                 len + copy > state->head->extra_max ?
                                 state->head->extra_max - len : copy);
                     }
                     if ((state->flags & 0x0200) && (state->wrap & 4))

Vulnerable code:                         state->head->extra != Z_NULL) {
                        len = state->head->extra_len - state->length;
Fixed code:                     len = state->head->extra_len - state->length;
                        state->head->extra != Z_NULL &&
                        len < state->head->extra_max) {
CVE-2021-31660: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2021-06-18T22:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2021-02-15 13:53:40 +0100
Commit message: Merge pull request #15947 from nmeum/pr/clif_get_attr_empty

clif: Don't access any data if input is empty
CVE-2021-31661: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: RIOT-OS 2021.01 before commit 609c9ada34da5546cffb632a98b7ba157c112658 contains a buffer overflow that could allow attackers to obtain sensitive information.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2021-06-18T22:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2021-02-10 08:50:10 +0100
Commit message: Merge pull request #15945 from nmeum/pr/clif_get_attr_bounds

clif: After incrementing pos, make sure it is still in bounds
CVE-2021-31662: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: RIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow which could allow attackers to obtain sensitive information.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2021-06-18T22:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2021-02-05 13:23:43 +0100
Commit message: Merge pull request #15930 from nmeum/pr/uri_parser_scheme

uri_parser: check if uri is long enough to even contain a ://
CVE-2021-31663: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: RIOT-OS 2021.01 before commit bc59d60be60dfc0a05def57d74985371e4f22d79 contains a buffer overflow which could allow attackers to obtain sensitive information.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2021-06-18T22:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2021-02-05 17:06:01 +0100
Commit message: Merge pull request #15929 from cgundogan/pr/uriparser

uri_parser: fix out-of-bounds and additional enhancements
CVE-2021-31664: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2021-06-18T22:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2020-10-31 12:57:17 +0100
Commit message: Merge pull request #15345 from nmeum/pr/sock_dns_overflow

sock_dns: Fix incorrect buffer bounds check
CVE-2023-24817: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer. Triggering the access at the right time will corrupt other packets or the allocator metadata. Corrupting a pointer will lead to denial of service. This issue is fixed in version 2023.04. As a workaround, disable SRH in the network stack.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 7.5
Published: 2023-05-30T16:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2023-04-21 11:52:40 +0200
Commit message: Merge pull request from GHSA-xjgw-7638-29g5

gnrc_rpl_srh: check header fields consistency before substraction
CVE-2023-24817: Out-of-bounds Write (CWE-787)
value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device resulting in an integer underflow and out of bounds access in the packet buffer. Triggering the access at the right time will corrupt other packets or the allocator metadata. Corrupting a pointer will lead to denial of service. This issue is fixed in version 2023.04. As a workaround, disable SRH in the network stack.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-05-30T16:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2023-04-21 11:52:40 +0200
Commit message: Merge pull request from GHSA-xjgw-7638-29g5

gnrc_rpl_srh: check header fields consistency before substraction
CVE-2023-24825: Unchecked Return Value (CWE-252)
value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.
CWE description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CVSS v3 base score: 7.5
Published: 2023-05-30T16:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2023-04-21 11:56:49 +0200
Commit message: Merge pull request from GHSA-xqm8-xj74-fjw2

gnrc_sixlowpan_iphc: check IPHC dispatch for truncation
CVE-2023-24825: NULL Pointer Dereference (CWE-476)
value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2023-05-30T16:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2023-04-21 11:56:49 +0200
Commit message: Merge pull request from GHSA-xqm8-xj74-fjw2

gnrc_sixlowpan_iphc: check IPHC dispatch for truncation
CVE-2023-24826: Access of Uninitialized Pointer (CWE-824)
value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object leading to denial of service. This issue is fixed in version 2023.04. As a workaround, disable fragment forwarding or SFR.
CWE description: The product accesses or uses a pointer that has not been initialized.
CVSS v3 base score: 7.5
Published: 2023-05-30T17:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: Unknown
Commit date: 2023-04-21 11:54:57 +0200
Commit message: Merge pull request from GHSA-xfj4-9g7w-f4gh

fixes for CVE-2023-24826
CVE-2023-33973: NULL Pointer Dereference (CWE-476)
value: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send a crafted frame which is forwarded by the device. During encoding of the packet a NULL pointer dereference occurs. This crashes the device leading to denial of service. A patch is available at pull request 19678. There are no known workarounds.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2023-05-30T17:15Z
Repository: https://github.com/RIOT-OS/RIOT
Language: C
Files changed: sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c
Commit date: 2023-05-30 14:27:13 +0200
Commit message: gnrc_sixlowpan_iphc: fix NULL pointer dereference

Diff: diff --git a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c b/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c
index 81fff4224bf..2dac17b3bd2 100644
--- a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c
+++ b/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c
@@ -1072,16 +1072,22 @@ static size_t _iphc_ipv6_encode(gnrc_pktsnip_t *pkt,
                                 const gnrc_netif_hdr_t *netif_hdr,
                                 gnrc_netif_t *iface,
                                 uint8_t *iphc_hdr)
 {
     gnrc_sixlowpan_ctx_t *src_ctx = NULL, *dst_ctx = NULL;
-    ipv6_hdr_t *ipv6_hdr = pkt->next->data;
+    ipv6_hdr_t *ipv6_hdr;
     bool addr_comp = false;
     uint16_t inline_pos = SIXLOWPAN_IPHC_HDR_LEN;
 
     assert(iface != NULL);
 
+    if (pkt->next == NULL) {
+        DEBUG("6lo iphc: packet missing header\n");
+        return 0;
+    }
+    ipv6_hdr = pkt->next->data;
+
     /* set initial dispatch value*/
     iphc_hdr[IPHC1_IDX] = SIXLOWPAN_IPHC1_DISP;
     iphc_hdr[IPHC2_IDX] = 0;
 
     /* check for available contexts */
@@ -1740,10 +1746,18 @@ void gnrc_sixlowpan_iphc_send(gnrc_pktsnip_t *pkt, void *ctx, unsigned page)
             return;
         }
         gnrc_sixlowpan_multiplex_by_size(tmp, orig_datagram_size, netif, page);
     }
     else {
+        if (IS_USED(MODULE_GNRC_SIXLOWPAN_FRAG_MINFWD)) {
+            gnrc_sixlowpan_frag_fb_t *fb = ctx;
+
+            if (fb->pkt == pkt) {
+                /* free provided fragmentation buffer */
+                fb->pkt = NULL;
+            }
+        }
         gnrc_pktbuf_release(pkt);
     }
 }
 
 /** @} */

Vulnerable code:     ipv6_hdr_t *ipv6_hdr = pkt->next->data;
Fixed code:     ipv6_hdr_t *ipv6_hdr;
    if (pkt->next == NULL) {
        DEBUG("6lo iphc: packet missing header\n");
        return 0;
    }
    ipv6_hdr = pkt->next->data;

        if (IS_USED(MODULE_GNRC_SIXLOWPAN_FRAG_MINFWD)) {
            gnrc_sixlowpan_frag_fb_t *fb = ctx;

            if (fb->pkt == pkt) {
                /* free provided fragmentation buffer */
                fb->pkt = NULL;
            }
        }
CVE-2021-41175: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-10-26T14:15Z
Repository: https://github.com/pi-hole/AdminLTE
Language: PHP
Files changed: scripts/pi-hole/js/groups-clients.js, scripts/pi-hole/php/groups.php
Commit date: 2021-10-23 19:26:07 +0100
Commit message: Merge pull request from GHSA-mhr8-7rvg-8r43

* Prevent possible XSS attack vector on add_client
Update JS code to prevent possible XSS vector

Co-authored-by: Harold Kim <root@stypr.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>

* Fix both addClient and deleteClient to prevent XSS

Signed-off-by: Harold Kim <root@stypr.com>

Co-authored-by: Harold Kim <root@stypr.com>
Diff: diff --git a/scripts/pi-hole/js/groups-clients.js b/scripts/pi-hole/js/groups-clients.js
index 07432638..268017d5 100644
--- a/scripts/pi-hole/js/groups-clients.js
+++ b/scripts/pi-hole/js/groups-clients.js
@@ -258,11 +258,11 @@ function initTable() {
     $("#resetButton").addClass("hidden");
   });
 }
 
 function addClient() {
-  var ip = $("#select").val().trim();
+  var ip = utils.escapeHtml($("#select").val().trim());
   var comment = utils.escapeHtml($("#new_comment").val());
 
   utils.disableAll();
   utils.showAlert("info", "", "Adding client...", ip);
 
@@ -383,11 +383,11 @@ function editClient() {
 }
 
 function deleteClient() {
   var tr = $(this).closest("tr");
   var id = tr.attr("data-id");
-  var ip = tr.find("#ip_" + id).text();
+  var ip = utils.escapeHtml(tr.find("#ip_" + id).text());
   var name = utils.escapeHtml(tr.find("#name_" + id).text());
 
   if (name.length > 0) {
     ip += " (" + name + ")";
   }
diff --git a/scripts/pi-hole/php/groups.php b/scripts/pi-hole/php/groups.php
index c7d61d81..29b8b5c8 100644
--- a/scripts/pi-hole/php/groups.php
+++ b/scripts/pi-hole/php/groups.php
@@ -345,10 +345,12 @@ if ($_POST['action'] == 'get_groups') {
         if (!$stmt) {
             throw new Exception('While preparing statement: ' . $db->lastErrorMsg());
         }
 
         foreach ($ips as $ip) {
+            // Encode $ip variable to prevent XSS
+            $ip = htmlspecialchars($ip);
             // Silently skip this entry when it is empty or not a string (e.g. NULL)
             if(!is_string($ip) || strlen($ip) == 0) {
                 continue;
             }
 

Vulnerable code:   var ip = $("#select").val().trim();
  var ip = tr.find("#ip_" + id).text();
Fixed code:   var ip = utils.escapeHtml($("#select").val().trim());
  var ip = utils.escapeHtml(tr.find("#ip_" + id).text());
            // Encode $ip variable to prevent XSS
            $ip = htmlspecialchars($ip);
CVE-2022-31029: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the risks. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-07-07T22:15Z
Repository: https://github.com/pi-hole/AdminLTE
Language: Unknown
Commit date: 2022-07-07 19:23:48 +0100
Commit message: Merge pull request from GHSA-cfr5-rqm5-9vhp

Fix/ghsa-cfr5-rqm5-9vhp - Possible XSS in queryads.php
CVE-2024-1118: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2024-02-07T11:15Z
Repository: https://github.com/podlove/podlove-subscribe-button-wp-plugin
Language: PHP
Files changed: model/base.php
Commit date: 2024-02-06 09:30:25 +0100
Commit message: fix: missing escaping in sql query

Diff: diff --git a/model/base.php b/model/base.php
index 2fa7cab..48a8c0c 100644
--- a/model/base.php
+++ b/model/base.php
@@ -208,13 +208,12 @@ abstract class Base {
 		
 		$class = get_called_class();
 		$model = new $class();
 		$model->flag_as_not_new();
 		
-		$row = $wpdb->get_row(
-			'SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'' . $value . '\' LIMIT 0,1'
-		);
+		$query = $wpdb->prepare('SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'%s\' LIMIT 0,1', $value);
+		$row = $wpdb->get_row($query);
 		
 		if ( ! $row ) {
 			return null;
 		}
 		

Vulnerable code: 		$row = $wpdb->get_row(
			'SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'' . $value . '\' LIMIT 0,1'
		);
Fixed code: 		$query = $wpdb->prepare('SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'%s\' LIMIT 0,1', $value);
		$row = $wpdb->get_row($query);
CVE-2019-15119: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 5.5
Published: 2019-08-16T15:15Z
Repository: https://github.com/cnlh/nps
Language: Go
Files changed: lib/install/install.go
Commit date: 2019-08-16 10:48:48 +0800
Commit message: Change to 755, fixes #176

Diff: diff --git a/lib/install/install.go b/lib/install/install.go
index 5b2a515..6bd20d4 100644
--- a/lib/install/install.go
+++ b/lib/install/install.go
@@ -31,15 +31,15 @@ func InstallNps() {
 	if !common.IsWindows() {
 		if _, err := copyFile(filepath.Join(common.GetAppPath(), "nps"), "/usr/bin/nps"); err != nil {
 			if _, err := copyFile(filepath.Join(common.GetAppPath(), "nps"), "/usr/local/bin/nps"); err != nil {
 				log.Fatalln(err)
 			} else {
-				os.Chmod("/usr/local/bin/nps", 0777)
+				os.Chmod("/usr/local/bin/nps", 0755)
 				log.Println("Executable files have been copied to", "/usr/local/bin/nps")
 			}
 		} else {
-			os.Chmod("/usr/bin/nps", 0777)
+			os.Chmod("/usr/bin/nps", 0755)
 			log.Println("Executable files have been copied to", "/usr/bin/nps")
 		}
 
 	}
 	log.Println("install ok!")

Vulnerable code: 				os.Chmod("/usr/local/bin/nps", 0777)
			os.Chmod("/usr/bin/nps", 0777)
Fixed code: 				os.Chmod("/usr/local/bin/nps", 0755)
			os.Chmod("/usr/bin/nps", 0755)