Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-32792: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-07-26T17:15Z
Repository: https://github.com/zmartzone/mod_auth_openidc
Language: Other
Files changed: ChangeLog, src/mod_auth_openidc.c
Commit date: 2021-06-25 11:42:57 +0200
Commit message: avoid XSS vulnerability when using OIDCPreservePost On

and supplying URLs that contain single quotes; thanks @oss-aimoto

Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
Diff: diff --git a/ChangeLog b/ChangeLog
index 038e47d3..27d5b865 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
+06/25/2021
+- avoid XSS vulnerability when using OIDCPreservePost On and supplying URLs that contain single quotes
+  thanks @oss-aimoto
+
 06/21/2021
 - strip A256GCM JWT header from encrypted JWTS used for state cookies, cache encryption and by-value session cookies
   resulting in smaller cookies and reduced cache content size
 
 06/10/2021
diff --git a/src/mod_auth_openidc.c b/src/mod_auth_openidc.c
index b1f99a6b..4f94743b 100644
--- a/src/mod_auth_openidc.c
+++ b/src/mod_auth_openidc.c
@@ -511,11 +511,11 @@ static int oidc_request_post_preserved_restore(request_rec *r,
 					"          input.name = str_decode(key);\n"
 					"          input.value = str_decode(mod_auth_openidc_preserve_post_params[key]);\n"
 					"          input.type = \"hidden\";\n"
 					"          document.forms[0].appendChild(input);\n"
 					"        }\n"
-					"        document.forms[0].action = '%s';\n"
+					"        document.forms[0].action = \"%s\";\n"
 					"        document.forms[0].submit();\n"
 					"      }\n"
 					"    </script>\n", method, original_url);
 
 	const char *body = "    <p>Restoring...</p>\n"

Vulnerable code: 					"        document.forms[0].action = '%s';\n"
Fixed code: 06/25/2021
- avoid XSS vulnerability when using OIDCPreservePost On and supplying URLs that contain single quotes
  thanks @oss-aimoto

					"        document.forms[0].action = \"%s\";\n"
CVE-2021-28848: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon processing a title change.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2021-06-03T12:15Z
Repository: https://github.com/mintty/mintty
Language: C
Files changed: src/termout.c
Commit date: 2021-02-13 11:48:37 +0100
Commit message: tame some window operations, just in case

Diff: diff --git a/src/termout.c b/src/termout.c
index ff30313..45d575e 100644
--- a/src/termout.c
+++ b/src/termout.c
@@ -2550,10 +2550,11 @@ do_winop(void)
       }
       else if (arg1 == 0) {
         win_maximise(0);
         win_set_chars(rows0, cols0);
       }
+      usleep(1000);
     }
     when 10:
       if (term.csi_argc != 2)
         return;
       // Ps = 1 0 ; 0  -> Undo full-screen mode.
@@ -2561,10 +2562,11 @@ do_winop(void)
       // Ps = 1 0 ; 2  -> Toggle full-screen.
       if (arg1 == 2)
         win_maximise(-2);
       else if (arg1 == 1 || arg1 == 0)
         win_maximise(arg1 ? 2 : 0);
+      usleep(1000);
     when 11: child_write(win_is_iconic() ? "\e[2t" : "\e[1t", 4);
     when 13: {
       int x, y;
       win_get_scrpos(&x, &y, arg1 == 2);
       child_printf("\e[3;%u;%ut", (ushort)x, (ushort)y);

Fixed code:       usleep(1000);
      usleep(1000);
CVE-2021-32696: Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
value: The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS.
CWE description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVSS v3 base score: 5.3
Published: 2021-06-18T20:15Z
Repository: https://github.com/ericnorris/striptags
Language: Unknown
Commit date: 2021-06-18 13:01:52 -0400
Commit message: Merge pull request from GHSA-qxg5-2qff-p49r

fix: throw TypeError if 'html' is non-string argument
CVE-2017-18013: NULL Pointer Dereference (CWE-476)
value: In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2018-01-01T08:29Z
Repository: https://gitlab.com/libtiff/libtiff
Language: C
Files changed: libtiff/tif_print.c
Commit date: 2017-12-31 15:09:41 +0100
Commit message: libtiff/tif_print.c: TIFFPrintDirectory(): fix null pointer dereference on corrupted file. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2770

Diff: diff --git a/libtiff/tif_print.c b/libtiff/tif_print.c
index 9959d353..8deceb2b 100644
--- a/libtiff/tif_print.c
+++ b/libtiff/tif_print.c
@@ -663,17 +663,17 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags)
 		    isTiled(tif) ? "Tiles" : "Strips");
 		for (s = 0; s < td->td_nstrips; s++)
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
 			fprintf(fd, "    %3lu: [%8I64u, %8I64u]\n",
 			    (unsigned long) s,
-			    (unsigned __int64) td->td_stripoffset[s],
-			    (unsigned __int64) td->td_stripbytecount[s]);
+			    td->td_stripoffset ? (unsigned __int64) td->td_stripoffset[s] : 0,
+			    td->td_stripbytecount ? (unsigned __int64) td->td_stripbytecount[s] : 0);
 #else
 			fprintf(fd, "    %3lu: [%8llu, %8llu]\n",
 			    (unsigned long) s,
-			    (unsigned long long) td->td_stripoffset[s],
-			    (unsigned long long) td->td_stripbytecount[s]);
+			    td->td_stripoffset ? (unsigned long long) td->td_stripoffset[s] : 0,
+			    td->td_stripbytecount ? (unsigned long long) td->td_stripbytecount[s] : 0);
 #endif
 	}
 }
 
 void

Vulnerable code: 			    (unsigned __int64) td->td_stripoffset[s],
			    (unsigned __int64) td->td_stripbytecount[s]);
			    (unsigned long long) td->td_stripoffset[s],
			    (unsigned long long) td->td_stripbytecount[s]);
Fixed code: 			    td->td_stripoffset ? (unsigned __int64) td->td_stripoffset[s] : 0,
			    td->td_stripbytecount ? (unsigned __int64) td->td_stripbytecount[s] : 0);
			    td->td_stripoffset ? (unsigned long long) td->td_stripoffset[s] : 0,
			    td->td_stripbytecount ? (unsigned long long) td->td_stripbytecount[s] : 0);
CVE-2018-8905: Out-of-bounds Write (CWE-787)
value: In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2018-03-22T04:29Z
Repository: https://gitlab.com/libtiff/libtiff
Language: C
Files changed: libtiff/tif_lzw.c
Commit date: 2018-05-12 15:32:31 +0200
Commit message: LZWDecodeCompat(): fix potential index-out-of-bounds write. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 / CVE-2018-8905

The fix consists in using the similar code LZWDecode() to validate we
don't write outside of the output buffer.

Diff: diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
index 4ccb443c..94d85e38 100644
--- a/libtiff/tif_lzw.c
+++ b/libtiff/tif_lzw.c
@@ -600,10 +600,11 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
 	char *op = (char*) op0;
 	long occ = (long) occ0;
 	char *tp;
 	unsigned char *bp;
 	int code, nbits;
+	int len;
 	long nextbits, nextdata, nbitsmask;
 	code_t *codep, *free_entp, *maxcodep, *oldcodep;
 
 	(void) s;
 	assert(sp != NULL);
@@ -751,17 +752,22 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
 					*--tp = codep->value;
 					codep = codep->next;
 				}  while (--occ);
 				break;
 			}
-			assert(occ >= codep->length);
-			op += codep->length;
-			occ -= codep->length;
-			tp = op;
+			len = codep->length;
+			tp = op + len;
 			do {
-				*--tp = codep->value;
-			} while( (codep = codep->next) != NULL );
+				int t;
+				--tp;
+				t = codep->value;
+				codep = codep->next;
+				*tp = (char)t;
+			} while (codep && tp > op);
+			assert(occ >= len);
+			op += len;
+			occ -= len;
 		} else {
 			*op++ = (char)code;
 			occ--;
 		}
 	}

Vulnerable code: 			assert(occ >= codep->length);
			op += codep->length;
			occ -= codep->length;
			tp = op;
				*--tp = codep->value;
			} while( (codep = codep->next) != NULL );
Fixed code: 	int len;
			len = codep->length;
			tp = op + len;
				int t;
				--tp;
				t = codep->value;
				codep = codep->next;
				*tp = (char)t;
			} while (codep && tp > op);
			assert(occ >= len);
			op += len;
			occ -= len;
CVE-2019-6128: Missing Release of Memory after Effective Lifetime (CWE-401)
value: The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 8.8
Published: 2019-01-11T05:29Z
Repository: https://gitlab.com/libtiff/libtiff
Language: C
Files changed: tools/pal2rgb.c
Commit date: 2019-01-23 15:09:59 -0500
Commit message: Fix for simple memory leak that was assigned CVE-2019-6128.

pal2rgb failed to free memory on a few errors. This was reported
here: http://bugzilla.maptools.org/show_bug.cgi?id=2836.

Diff: diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
index 01d8502e..9492f1cf 100644
--- a/tools/pal2rgb.c
+++ b/tools/pal2rgb.c
@@ -116,28 +116,33 @@ main(int argc, char* argv[])
 		return (-1);
 	if (!TIFFGetField(in, TIFFTAG_PHOTOMETRIC, &shortv) ||
 	    shortv != PHOTOMETRIC_PALETTE) {
 		fprintf(stderr, "%s: Expecting a palette image.\n",
 		    argv[optind]);
+		(void) TIFFClose(in);
 		return (-1);
 	}
 	if (!TIFFGetField(in, TIFFTAG_COLORMAP, &rmap, &gmap, &bmap)) {
 		fprintf(stderr,
 		    "%s: No colormap (not a valid palette image).\n",
 		    argv[optind]);
+		(void) TIFFClose(in);
 		return (-1);
 	}
 	bitspersample = 0;
 	TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bitspersample);
 	if (bitspersample != 8) {
 		fprintf(stderr, "%s: Sorry, can only handle 8-bit images.\n",
 		    argv[optind]);
+		(void) TIFFClose(in);
 		return (-1);
 	}
 	out = TIFFOpen(argv[optind+1], "w");
-	if (out == NULL)
+	if (out == NULL) {
+		(void) TIFFClose(in);
 		return (-2);
+	}
 	cpTags(in, out);
 	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &imagewidth);
 	TIFFGetField(in, TIFFTAG_IMAGELENGTH, &imagelength);
 	if (compression != (uint16)-1)
 		TIFFSetField(out, TIFFTAG_COMPRESSION, compression);

Vulnerable code: 	if (out == NULL)
Fixed code: 		(void) TIFFClose(in);
		(void) TIFFClose(in);
		(void) TIFFClose(in);
	if (out == NULL) {
		(void) TIFFClose(in);
	}
CVE-2019-7663: Insufficient Information (NVD-CWE-noinfo)
value: An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2019-02-09T16:29Z
Repository: https://gitlab.com/libtiff/libtiff
Language: C
Files changed: libtiff/tif_dirwrite.c
Commit date: 2019-01-29 11:21:47 +0100
Commit message: TIFFWriteDirectoryTagTransferfunction() : fix NULL dereferencing

http://bugzilla.maptools.org/show_bug.cgi?id=2833

we must check the pointer is not NULL before memcmp() the memory

Diff: diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
index c15a28db..ef30c869 100644
--- a/libtiff/tif_dirwrite.c
+++ b/libtiff/tif_dirwrite.c
@@ -1891,16 +1891,18 @@ TIFFWriteDirectoryTagTransferfunction(TIFF* tif, uint32* ndir, TIFFDirEntry* dir
 	 */
 	if (n>3)
 		n=3;
 	if (n==3)
 	{
-		if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16)))
+		if (tif->tif_dir.td_transferfunction[2] == NULL ||
+		    !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16)))
 			n=2;
 	}
 	if (n==2)
 	{
-		if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16)))
+		if (tif->tif_dir.td_transferfunction[1] == NULL ||
+		    !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16)))
 			n=1;
 	}
 	if (n==0)
 		n=1;
 	o=_TIFFmalloc(n*m*sizeof(uint16));

Vulnerable code: 		if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16)))
		if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16)))
Fixed code: 		if (tif->tif_dir.td_transferfunction[2] == NULL ||
		    !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16)))
		if (tif->tif_dir.td_transferfunction[1] == NULL ||
		    !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16)))
CVE-2024-1433: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginId leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-253407. NOTE: This requires write access to user's home or the installation of third party global themes.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2024-02-11T23:15Z
Repository: https://github.com/KDE/plasma-workspace
Language: C++
Files changed: components/calendar/eventpluginsmanager.cpp
Commit date: 2024-02-03 10:24:23 +0000
Commit message: plasmacalendarintegration: Fix directory traversal vulnerability in events plugins

digital-calendar plasma applet is vulnerable to directory traversal attack which allows an arbitrary .so library file to be leaded as a plasma calendar plugin.

This vulnerability can be triggered via theme files that provide a config for the digital-clock applet which includes `enabledCalendarPlugins` that uses directory traversal to load arbitrary .so from the filesystem.

This requires write access to user's home or the installation of third party global themes so is not directly exploitable by anything which did not have access already, however it should be fixed regardless.

Diff: diff --git a/components/calendar/eventpluginsmanager.cpp b/components/calendar/eventpluginsmanager.cpp
index 63a2c4460..a982c18a2 100644
--- a/components/calendar/eventpluginsmanager.cpp
+++ b/components/calendar/eventpluginsmanager.cpp
@@ -199,11 +199,11 @@ QStringList EventPluginsManager::enabledPlugins() const
     return d->enabledPlugins;
 }
 
 void EventPluginsManager::loadPlugin(const QString &pluginId)
 {
-    QPluginLoader loader("plasmacalendarplugins/" + pluginId);
+    QPluginLoader loader("plasmacalendarplugins/" + QDir::cleanPath(pluginId));
 
     if (!loader.load()) {
         qWarning() << "Could not create Plasma Calendar Plugin: " << pluginId;
         qWarning() << loader.errorString();
         return;

Vulnerable code:     QPluginLoader loader("plasmacalendarplugins/" + pluginId);
Fixed code:     QPluginLoader loader("plasmacalendarplugins/" + QDir::cleanPath(pluginId));
CVE-2022-4890: Deserialization of Untrusted Data (CWE-502)
value: A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The patch is named b067372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218387.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2023-01-16T13:15Z
Repository: https://github.com/abhilash1985/PredictApp
Language: Ruby
Files changed: config/initializers/new_framework_defaults_7_0.rb
Commit date: 2022-03-21 08:59:39 +0530
Commit message: fixed security vulnerability

Diff: diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
index d8fb474..883499e 100644
--- a/config/initializers/new_framework_defaults_7_0.rb
+++ b/config/initializers/new_framework_defaults_7_0.rb
@@ -90,11 +90,11 @@
 # Continue to use `:marshal` for backward-compatibility with old cookies.
 #
 # If you have configured the serializer elsewhere, you can remove this.
 #
 # See https://guides.rubyonrails.org/action_controller_overview.html#cookies for more information.
-Rails.application.config.action_dispatch.cookies_serializer = :hybrid
+Rails.application.config.action_dispatch.cookies_serializer = :json
 
 # Enable parameter wrapping for JSON.
 # Previously this was set in an initializer. It's fine to keep using that initializer if you've customized it.
 # To disable parameter wrapping entirely, set this config to `false`.
 # Rails.application.config.action_controller.wrap_parameters_by_default = true

Vulnerable code: Rails.application.config.action_dispatch.cookies_serializer = :hybrid
Fixed code: Rails.application.config.action_dispatch.cookies_serializer = :json
CVE-2020-15086: Other (NVD-CWE-Other)
value: In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation. This is fixed in version 7.6.5 of the "mediace" extension for TYPO3.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2020-07-29T17:15Z
Repository: https://github.com/FriendsOfTYPO3/mediace
Language: PHP
Files changed: Resources/PHP/ValidateHashEID.php
Commit date: 2020-07-16 09:31:32 +0200
Commit message: [SECURITY] Restrict file validation hash generation

Security-References: CVE-2020-15086

Diff: diff --git a/Resources/PHP/ValidateHashEID.php b/Resources/PHP/ValidateHashEID.php
index e2ee58b..71f1481 100644
--- a/Resources/PHP/ValidateHashEID.php
+++ b/Resources/PHP/ValidateHashEID.php
@@ -12,14 +12,19 @@
  * The TYPO3 project - inspiring people to share!
  */
 
 call_user_func(function() {
     $value = \TYPO3\CMS\Core\Utility\GeneralUtility::_GET('value');
-    $addition = \TYPO3\CMS\Core\Utility\GeneralUtility::_GET('addition');
     $scope = \TYPO3\CMS\Core\Utility\GeneralUtility::_GET('scope');
 
-    $content = \TYPO3\CMS\Core\Utility\GeneralUtility::hmac($value, $addition);
+    if (!is_string($value) || empty($value)) {
+        \TYPO3\CMS\Core\Utility\HttpUtility::setResponseCodeAndExit(
+            \TYPO3\CMS\Core\Utility\HttpUtility::HTTP_STATUS_400
+        );
+    }
+
+    $content = \TYPO3\CMS\Core\Utility\GeneralUtility::hmac($value, 'flashvars');
 
     if ($scope === 'flashvars') {
         header('Content-type: application/x-www-form-urlencoded');
         $content = 'hash=' . $content;
     } else {

Vulnerable code:     $addition = \TYPO3\CMS\Core\Utility\GeneralUtility::_GET('addition');
    $content = \TYPO3\CMS\Core\Utility\GeneralUtility::hmac($value, $addition);
Fixed code:     if (!is_string($value) || empty($value)) {
        \TYPO3\CMS\Core\Utility\HttpUtility::setResponseCodeAndExit(
            \TYPO3\CMS\Core\Utility\HttpUtility::HTTP_STATUS_400
        );
    }

    $content = \TYPO3\CMS\Core\Utility\GeneralUtility::hmac($value, 'flashvars');
CVE-2023-34102: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)
value: Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
CWE description: The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
CVSS v3 base score: 8.8
Published: 2023-06-05T23:15Z
Repository: https://github.com/avo-hq/avo
Language: Ruby
Files changed: lib/avo/fields/belongs_to_field.rb
Commit date: 2023-06-06 01:06:58 +0300
Commit message: Merge pull request from GHSA-86h2-2g4g-29qx

* fix vuln

* wip
Diff: diff --git a/lib/avo/fields/belongs_to_field.rb b/lib/avo/fields/belongs_to_field.rb
index 0c156c5e..dc77f6a8 100644
--- a/lib/avo/fields/belongs_to_field.rb
+++ b/lib/avo/fields/belongs_to_field.rb
@@ -197,15 +197,17 @@ module Avo
       end
 
       def fill_field(model, key, value, params)
         return model unless model.methods.include? key.to_sym
 
+        valid_model_class = valid_polymorphic_class params["#{polymorphic_as}_type"]
+
         if polymorphic_as.present?
-          model.send("#{polymorphic_as}_type=", params["#{polymorphic_as}_type"])
+          model.send("#{polymorphic_as}_type=", valid_model_class)
 
           # If the type is blank, reset the id too.
-          if params["#{polymorphic_as}_type"].blank?
+          if valid_model_class.blank?
             model.send("#{polymorphic_as}_id=", nil)
           else
             model.send("#{polymorphic_as}_id=", params["#{polymorphic_as}_id"])
           end
         else
@@ -213,10 +215,16 @@ module Avo
         end
 
         model
       end
 
+      def valid_polymorphic_class(possible_class)
+        types.find do |type|
+          type.to_s == possible_class.to_s
+        end
+      end
+
       def database_id
         # If the field is a polymorphic value, return the polymorphic_type as key and pre-fill the _id in fill_field.
         return "#{polymorphic_as}_type" if polymorphic_as.present?
 
         foreign_key

Vulnerable code:           model.send("#{polymorphic_as}_type=", params["#{polymorphic_as}_type"])
          if params["#{polymorphic_as}_type"].blank?
Fixed code:         valid_model_class = valid_polymorphic_class params["#{polymorphic_as}_type"]

          model.send("#{polymorphic_as}_type=", valid_model_class)
          if valid_model_class.blank?
      def valid_polymorphic_class(possible_class)
        types.find do |type|
          type.to_s == possible_class.to_s
        end
      end
CVE-2015-7510: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-09-25T21:29Z
Repository: https://github.com/keszybz/systemd
Language: C
Files changed: src/nss-mymachines/nss-mymachines.c
Commit date: 2015-11-23 13:59:43 -0500
Commit message: nss-mymachines: do not allow overlong machine names

https://github.com/systemd/systemd/issues/2002

Diff: diff --git a/src/nss-mymachines/nss-mymachines.c b/src/nss-mymachines/nss-mymachines.c
index 969fa9619..c98a959b3 100644
--- a/src/nss-mymachines/nss-mymachines.c
+++ b/src/nss-mymachines/nss-mymachines.c
@@ -414,10 +414,13 @@ enum nss_status _nss_mymachines_getpwnam_r(
 
         e = strrchr(p, '-');
         if (!e || e == p)
                 goto not_found;
 
+        if (e - p > HOST_NAME_MAX - 1) /* -1 for the last dash */
+                goto not_found;
+
         r = parse_uid(e + 1, &uid);
         if (r < 0)
                 goto not_found;
 
         machine = strndupa(p, e - p);
@@ -571,10 +574,13 @@ enum nss_status _nss_mymachines_getgrnam_r(
 
         e = strrchr(p, '-');
         if (!e || e == p)
                 goto not_found;
 
+        if (e - p > HOST_NAME_MAX - 1)  /* -1 for the last dash */
+                goto not_found;
+
         r = parse_gid(e + 1, &gid);
         if (r < 0)
                 goto not_found;
 
         machine = strndupa(p, e - p);

Fixed code:         if (e - p > HOST_NAME_MAX - 1) /* -1 for the last dash */
                goto not_found;

        if (e - p > HOST_NAME_MAX - 1)  /* -1 for the last dash */
                goto not_found;
CVE-2020-35236: Insufficient Information (NVD-CWE-noinfo)
value: The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2020-12-14T05:15Z
Repository: https://github.com/amazeeio/lagoon
Language: Unknown
Commit date: 2020-12-11 16:07:18 -0500
Commit message: Merge pull request #6 from amazeeio/AIOSEC-85-insecure-gitlab-project-delete

Aiosec 85 insecure gitlab project delete
CVE-2020-36632: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-12-25T20:15Z
Repository: https://github.com/hughsk/flat
Language: JavaScript
Files changed: index.js
Commit date: 2020-08-06 11:14:52 -0400
Commit message: Fix prototype pollution on unflatten

Fixes #105.

Diff: diff --git a/index.js b/index.js
index c8032e9..7193884 100644
--- a/index.js
+++ b/index.js
@@ -114,10 +114,14 @@ function unflatten (target, opts) {
     let key1 = getkey(split.shift())
     let key2 = getkey(split[0])
     let recipient = result
 
     while (key2 !== undefined) {
+      if (key1 === '__proto__') {
+        return
+      }
+
       const type = Object.prototype.toString.call(recipient[key1])
       const isobject = (
         type === '[object Object]' ||
         type === '[object Array]'
       )

Fixed code:       if (key1 === '__proto__') {
        return
      }
CVE-2023-48312: Improper Authentication (CWE-287)
value: capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2023-11-24T18:15Z
Repository: https://github.com/projectcapsule/capsule-proxy
Language: Go
Files changed: internal/request/http.go
Commit date: 2023-11-23 12:29:42 +0100
Commit message: fix: fix authentication bypass for capsule-proxy

- fix authentication bypass for capsule-proxy with leading token

Signed-off-by: slimm609 <dbrian@vmware.com>

Diff: diff --git a/internal/request/http.go b/internal/request/http.go
index ef95f05..c72bef2 100644
--- a/internal/request/http.go
+++ b/internal/request/http.go
@@ -112,10 +112,14 @@ func (h http) processBearerToken() (username string, groups []string, err error)
 
 	if err = h.client.Create(h.Request.Context(), tr); err != nil {
 		return "", nil, fmt.Errorf("cannot create TokenReview")
 	}
 
+	if !tr.Status.Authenticated {
+		return "", nil, fmt.Errorf("cannot verify the token due to error")
+	}
+
 	if statusErr := tr.Status.Error; len(statusErr) > 0 {
 		return "", nil, fmt.Errorf("cannot verify the token due to error")
 	}
 
 	return tr.Status.User.Username, tr.Status.User.Groups, nil

Fixed code: 	if !tr.Status.Authenticated {
		return "", nil, fmt.Errorf("cannot verify the token due to error")
	}
CVE-2013-10021: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.8.1 is able to address this issue. The patch is named 0842af8f8a556bc3e39b9ef758173b0a8a9ccbfc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222739.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-11T21:15Z
Repository: https://github.com/dd32/debug-bar
Language: PHP
Files changed: panels/class-debug-bar-queries.php
Commit date: 2013-05-15 11:51:16 +0000
Commit message: debug-bar: Security: prevent reflective xss in older browsers by escaping output generated by URL-less add_query_arg call props batmoo.
Imported from https://plugins.trac.wordpress.org/changeset/713401/debug-bar
Diff: diff --git a/panels/class-debug-bar-queries.php b/panels/class-debug-bar-queries.php
index cf45f66..9858e97 100644
--- a/panels/class-debug-bar-queries.php
+++ b/panels/class-debug-bar-queries.php
@@ -23,11 +23,11 @@ class Debug_Bar_Queries extends Debug_Bar_Panel {
 
 		if ( !empty($wpdb->queries) ) {
 			$show_many = isset($_GET['debug_queries']);
 
 			if ( $wpdb->num_queries > 500 && !$show_many )
-				$out .= "<p>" . sprintf( __('There are too many queries to show easily! <a href="%s">Show them anyway</a>', 'debug-bar'), add_query_arg( 'debug_queries', 'true' ) ) . "</p>";
+				$out .= "<p>" . sprintf( __('There are too many queries to show easily! <a href="%s">Show them anyway</a>', 'debug-bar'), esc_url( add_query_arg( 'debug_queries', 'true' ) ) ) . "</p>";
 
 			$out .= '<ol class="wpd-queries">';
 			$counter = 0;
 
 			foreach ( $wpdb->queries as $q ) {

Vulnerable code: 				$out .= "<p>" . sprintf( __('There are too many queries to show easily! <a href="%s">Show them anyway</a>', 'debug-bar'), add_query_arg( 'debug_queries', 'true' ) ) . "</p>";
Fixed code: 				$out .= "<p>" . sprintf( __('There are too many queries to show easily! <a href="%s">Show them anyway</a>', 'debug-bar'), esc_url( add_query_arg( 'debug_queries', 'true' ) ) ) . "</p>";
CVE-2022-23470: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and higher, after the switch to gunicorn, which serve static contents directly.  Additionally, the vulnerability is mitigated when using Nginx or Apache to serve /static/* contents, instead of Galaxy's internal middleware. This issue has been patched in commit `e5e6bda4f` and will be included in future releases. Users are advised to manually patch their installations. There are no known workarounds for this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-12-06T18:15Z
Repository: https://github.com/galaxyproject/galaxy
Language: Python
Files changed: lib/galaxy/web/framework/middleware/static.py
Commit date: 2022-12-05 14:35:56 -0500
Commit message: Contain directory traversal for static files to host static root.

Diff: diff --git a/lib/galaxy/web/framework/middleware/static.py b/lib/galaxy/web/framework/middleware/static.py
index fcc878f16f..50a94faf25 100644
--- a/lib/galaxy/web/framework/middleware/static.py
+++ b/lib/galaxy/web/framework/middleware/static.py
@@ -36,11 +36,15 @@ class CacheableStaticURLParser(StaticURLParser):
             for host_key, host_val in self.directory_per_host.items():
                 if host_key in host:
                     directory = host_val
                     break
 
-        full = os.path.join(directory, filename)
+        full = self.normpath(os.path.join(directory, filename))
+        if not full.startswith(directory):
+            # Out of bounds
+            return self.not_found(environ, start_response)
+
         if not os.path.exists(full):
             return self.not_found(environ, start_response)
         if os.path.isdir(full):
             # @@: Cache?
             return self.__class__(full)(environ, start_response)

Vulnerable code:         full = os.path.join(directory, filename)
Fixed code:         full = self.normpath(os.path.join(directory, filename))
        if not full.startswith(directory):
            # Out of bounds
            return self.not_found(environ, start_response)
CVE-2024-28854: Insufficient Information (NVD-CWE-noinfo)
value: tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.


CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-15T19:15Z
Repository: https://github.com/tmccombs/tls-listener
Language: Unknown
Commit date: 2024-03-15 00:09:37 -0600
Commit message: Merge pull request from GHSA-2qph-qpvm-2qf7

Continue accepting incoming connections if no TLS connection is ready.
CVE-2022-36038: Deserialization of Untrusted Data (CWE-502)
value: CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution (RCE) vulnerability in CircuitVerse allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue may lead to Remote Code Execution (RCE). A patch is available in commit number 7b3023a99499a7675f10f2c1d9effdf10c35fb6e. There are currently no known workarounds.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 7.8
Published: 2022-09-06T19:15Z
Repository: https://github.com/CircuitVerse/CircuitVerse
Language: Ruby
Files changed: app/helpers/simulator_helper.rb
Commit date: 2022-08-23 14:42:56 +0530
Commit message: security: use Oj.safe_load to process json payload

`Oj#load` method is not safe for processing user input and can have serious impacts.
Diff: diff --git a/app/helpers/simulator_helper.rb b/app/helpers/simulator_helper.rb
index f8e83aa..10c3153 100644
--- a/app/helpers/simulator_helper.rb
+++ b/app/helpers/simulator_helper.rb
@@ -21,12 +21,12 @@ module SimulatorHelper
   end
 
   def sanitize_data(project, data)
     return data if project&.assignment_id.blank? || data.blank?
 
-    data = Oj.load(data)
-    saved_restricted_elements = Oj.load(project.assignment.restrictions)
+    data = Oj.safe_load(data)
+    saved_restricted_elements = Oj.safe_load(project.assignment.restrictions)
     scopes = data["scopes"] || []
 
     parsed_scopes = scopes.each_with_object([]) do |scope, new_scopes|
       restricted_elements_used = []
 

Vulnerable code:     data = Oj.load(data)
    saved_restricted_elements = Oj.load(project.assignment.restrictions)
Fixed code:     data = Oj.safe_load(data)
    saved_restricted_elements = Oj.safe_load(project.assignment.restrictions)
CVE-2021-39218: Out-of-bounds Read (CWE-125)
value: Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes. Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types`.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.3
Published: 2021-09-17T21:15Z
Repository: https://github.com/bytecodealliance/wasmtime
Language: Unknown
Commit date: 2021-09-17 10:28:50 -0700
Commit message: Merge pull request from GHSA-4873-36h9-wv49

Stop doing fuzzy search for stack maps
CVE-2021-39218: Free of Memory not on the Heap (CWE-590)
value: Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes. Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types`.
CWE description: The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
CVSS v3 base score: 6.3
Published: 2021-09-17T21:15Z
Repository: https://github.com/bytecodealliance/wasmtime
Language: Unknown
Commit date: 2021-09-17 10:28:50 -0700
Commit message: Merge pull request from GHSA-4873-36h9-wv49

Stop doing fuzzy search for stack maps
CVE-2021-39218: Out-of-bounds Write (CWE-787)
value: Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes. Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types`.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.3
Published: 2021-09-17T21:15Z
Repository: https://github.com/bytecodealliance/wasmtime
Language: Unknown
Commit date: 2021-09-17 10:28:50 -0700
Commit message: Merge pull request from GHSA-4873-36h9-wv49

Stop doing fuzzy search for stack maps