Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2016-10268: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 7.8
Published: 2017-03-24T19:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcp.c
Commit date: 2016-12-02 22:13:32 +0000
Commit message: * tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips that
can cause various issues, such as buffer overflows in the library.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2598

Diff: diff --git a/ChangeLog b/ChangeLog
index 668b66add..0f154d662 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-12-02 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips that 
+	can cause various issues, such as buffer overflows in the library.
+	Reported by Agostino Sarubbo.
+	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2598
+
 2016-12-02 Even Rouault <even.rouault at spatialys.com>
 
 	* libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in
 	TIFFReadEncodedStrip() that caused an integer division by zero.
 	Reported by Agostino Sarubbo.
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
index a99c9064d..f294ed104 100644
--- a/tools/tiffcp.c
+++ b/tools/tiffcp.c
@@ -983,11 +983,11 @@ DECLAREcpFunc(cpDecodedStrips)
 	(void) imagewidth; (void) spp;
 	if (buf) {
 		tstrip_t s, ns = TIFFNumberOfStrips(in);
 		uint32 row = 0;
 		_TIFFmemset(buf, 0, stripsize);
-		for (s = 0; s < ns; s++) {
+		for (s = 0; s < ns && row < imagelength; s++) {
 			tsize_t cc = (row + rowsperstrip > imagelength) ?
 			    TIFFVStripSize(in, imagelength - row) : stripsize;
 			if (TIFFReadEncodedStrip(in, s, buf, cc) < 0
 			    && !ignore) {
 				TIFFError(TIFFFileName(in),

Vulnerable code: 		for (s = 0; s < ns; s++) {
Fixed code: 2016-12-02 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcp.c: avoid uint32 underflow in cpDecodedStrips that 
	can cause various issues, such as buffer overflows in the library.
	Reported by Agostino Sarubbo.
	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2598

		for (s = 0; s < ns && row < imagelength; s++) {
CVE-2016-10271: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: tools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read and buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 1" and libtiff/tif_fax3.c:413:13.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-03-24T19:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcrop.c
Commit date: 2016-12-03 11:35:56 +0000
Commit message: * tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
that the output buffer is correctly incremented to avoid write outside bounds.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620

Diff: diff --git a/ChangeLog b/ChangeLog
index 5b23665b1..d6a416bd5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-12-03 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
+	that the output buffer is correctly incremented to avoid write outside bounds.
+	Reported by Agostino Sarubbo.
+	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620
+
 2016-12-03 Even Rouault <even.rouault at spatialys.com>
 
 	* libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
 	OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
 	Reported by Agostino Sarubbo.
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index b87a77a89..70a71e17b 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -3696,11 +3696,11 @@ static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
                 if (bytes_read < 0 && !ignore) {
                         TIFFError("", "Error reading strip %lu after %lu rows",
                                   (unsigned long) strip, (unsigned long)rows);
                         return 0;
                 }
-                bufp += bytes_read;
+                bufp += stripsize;
         }
 
         return 1;
 } /* end readContigStripsIntoBuffer */
 

Vulnerable code:                 bufp += bytes_read;
Fixed code: 2016-12-03 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
	that the output buffer is correctly incremented to avoid write outside bounds.
	Reported by Agostino Sarubbo.
	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620

                bufp += stripsize;
CVE-2016-10272: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "WRITE of size 2048" and libtiff/tif_next.c:64:9.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-03-24T19:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcrop.c
Commit date: 2016-12-03 11:35:56 +0000
Commit message: * tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
that the output buffer is correctly incremented to avoid write outside bounds.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620

Diff: diff --git a/ChangeLog b/ChangeLog
index 5b23665b1..d6a416bd5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-12-03 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
+	that the output buffer is correctly incremented to avoid write outside bounds.
+	Reported by Agostino Sarubbo.
+	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620
+
 2016-12-03 Even Rouault <even.rouault at spatialys.com>
 
 	* libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
 	OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
 	Reported by Agostino Sarubbo.
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index b87a77a89..70a71e17b 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -3696,11 +3696,11 @@ static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
                 if (bytes_read < 0 && !ignore) {
                         TIFFError("", "Error reading strip %lu after %lu rows",
                                   (unsigned long) strip, (unsigned long)rows);
                         return 0;
                 }
-                bufp += bytes_read;
+                bufp += stripsize;
         }
 
         return 1;
 } /* end readContigStripsIntoBuffer */
 

Vulnerable code:                 bufp += bytes_read;
Fixed code: 2016-12-03 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
	that the output buffer is correctly incremented to avoid write outside bounds.
	Reported by Agostino Sarubbo.
	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620

                bufp += stripsize;
CVE-2016-9539: Out-of-bounds Read (CWE-125)
value: tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2016-11-22T19:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcrop.c
Commit date: 2016-10-14 19:13:20 +0000
Commit message: * tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in
readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel Souchet
& Vishal Chauhan from the MSRC Vulnerabilities & Mitigations team.

Diff: diff --git a/ChangeLog b/ChangeLog
index d6e718de1..84d016d72 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
+2016-10-14 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in
+	readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel Souchet
+	& Vishal Chauhan from the MSRC Vulnerabilities & Mitigations team.
+
 2016-10-09 Even Rouault <even.rouault at spatialys.com>
 
 	* tools/tiff2pdf.c: fix write buffer overflow of 2 bytes on JPEG
 	compressed images. Reported by Tyler Bohan of Cisco Talos as
 	TALOS-CAN-0187 / CVE-2016-5652.
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index eb6de77cb..471773735 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -817,13 +817,22 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
     	TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
         exit(-1);
     }
     }
 
-  tilebuf = _TIFFmalloc(tile_buffsize);
+  /* Add 3 padding bytes for extractContigSamplesShifted32bits */
+  if( tile_buffsize > 0xFFFFFFFFU - 3 )
+  {
+      TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
+      exit(-1);
+  }
+  tilebuf = _TIFFmalloc(tile_buffsize + 3);
   if (tilebuf == 0)
     return 0;
+  tilebuf[tile_buffsize] = 0;
+  tilebuf[tile_buffsize+1] = 0;
+  tilebuf[tile_buffsize+2] = 0;
 
   dst_rowsize = ((imagewidth * bps * spp) + 7) / 8;  
   for (row = 0; row < imagelength; row += tl)
     {
     nrow = (row + tl > imagelength) ? imagelength - row : tl;

Vulnerable code:   tilebuf = _TIFFmalloc(tile_buffsize);
Fixed code: 2016-10-14 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in
	readContigTilesIntoBuffer(). Reported as MSVR 35092 by Axel Souchet
	& Vishal Chauhan from the MSRC Vulnerabilities & Mitigations team.

  /* Add 3 padding bytes for extractContigSamplesShifted32bits */
  if( tile_buffsize > 0xFFFFFFFFU - 3 )
  {
      TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
      exit(-1);
  }
  tilebuf = _TIFFmalloc(tile_buffsize + 3);
  tilebuf[tile_buffsize] = 0;
  tilebuf[tile_buffsize+1] = 0;
  tilebuf[tile_buffsize+2] = 0;
CVE-2016-9540: Out-of-bounds Write (CWE-787)
value: tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow."
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2016-11-22T19:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcp.c
Commit date: 2016-10-08 15:54:56 +0000
Commit message: * tools/tiffcp.c: fix out-of-bounds write on tiled images with odd
tile width vs image width. Reported as MSVR 35103
by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
Mitigations team.

Diff: diff --git a/ChangeLog b/ChangeLog
index 8b57d1b18..d38f3a51c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-10-08 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcp.c: fix out-of-bounds write on tiled images with odd
+	tile width vs image width. Reported as MSVR 35103
+	by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
+	Mitigations team.
+
 2016-10-08 Even Rouault <even.rouault at spatialys.com>
 
 	* tools/tiff2pdf.c: fix read -largely- outsize of buffer in
 	t2p_readwrite_pdf_image_tile(), causing crash, when reading a
 	JPEG compressed image with TIFFTAG_JPEGTABLES length being one.
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
index 4ad74d391..a99c9064d 100644
--- a/tools/tiffcp.c
+++ b/tools/tiffcp.c
@@ -1336,11 +1336,11 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
 	for (row = 0; row < imagelength; row += tl) {
 		uint32 nrow = (row+tl > imagelength) ? imagelength-row : tl;
 		uint32 colb = 0;
 		uint32 col;
 
-		for (col = 0; col < imagewidth; col += tw) {
+		for (col = 0; col < imagewidth && colb < imagew; col += tw) {
 			if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0
 			    && !ignore) {
 				TIFFError(TIFFFileName(in),
 				    "Error, can't read tile at %lu %lu",
 				    (unsigned long) col,
@@ -1521,11 +1521,11 @@ DECLAREwriteFunc(writeBufferToContigTiles)
 	for (row = 0; row < imagelength; row += tilelength) {
 		uint32 nrow = (row+tl > imagelength) ? imagelength-row : tl;
 		uint32 colb = 0;
 		uint32 col;
 
-		for (col = 0; col < imagewidth; col += tw) {
+		for (col = 0; col < imagewidth && colb < imagew; col += tw) {
 			/*
 			 * Tile is clipped horizontally.  Calculate
 			 * visible portion and skewing factors.
 			 */
 			if (colb + tilew > imagew) {

Vulnerable code: 		for (col = 0; col < imagewidth; col += tw) {
		for (col = 0; col < imagewidth; col += tw) {
Fixed code: 2016-10-08 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcp.c: fix out-of-bounds write on tiled images with odd
	tile width vs image width. Reported as MSVR 35103
	by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
	Mitigations team.

		for (col = 0; col < imagewidth && colb < imagew; col += tw) {
		for (col = 0; col < imagewidth && colb < imagew; col += tw) {
CVE-2019-11471: Use After Free (CWE-416)
value: libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 8.8
Published: 2019-04-23T14:29Z
Repository: https://github.com/strukturag/libheif
Language: C++
Files changed: libheif/heif_context.cc
Commit date: 2019-04-15 09:07:27 +0200
Commit message: Detect non-existing referenced alpha images (fixes #123)

Diff: diff --git a/fuzzing/corpus/uaf_heif_context.h_117_1.heic b/fuzzing/corpus/uaf_heif_context.h_117_1.heic
new file mode 100644
index 0000000..c8826b4
Binary files /dev/null and b/fuzzing/corpus/uaf_heif_context.h_117_1.heic differ
diff --git a/libheif/heif_context.cc b/libheif/heif_context.cc
index fac3bd9..4fe9ba0 100644
--- a/libheif/heif_context.cc
+++ b/libheif/heif_context.cc
@@ -574,10 +574,15 @@ Error HeifContext::interpret_heif_file()
           if (auxC_property->get_aux_type() == "urn:mpeg:avc:2015:auxid:1" ||
               auxC_property->get_aux_type() == "urn:mpeg:hevc:2015:auxid:1") {
             image->set_is_alpha_channel_of(refs[0]);
 
             auto master_iter = m_all_images.find(refs[0]);
+            if (master_iter == m_all_images.end()) {
+              return Error(heif_error_Invalid_input,
+                           heif_suberror_Nonexisting_item_referenced,
+                           "Non-existing alpha image referenced");
+            }
             if (image.get() == master_iter->second.get()) {
               return Error(heif_error_Invalid_input,
                            heif_suberror_Nonexisting_item_referenced,
                            "Recursive alpha image detected");
             }

Fixed code:             if (master_iter == m_all_images.end()) {
              return Error(heif_error_Invalid_input,
                           heif_suberror_Nonexisting_item_referenced,
                           "Non-existing alpha image referenced");
            }
CVE-2020-19499: Out-of-bounds Read (CWE-125)
value: An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2021-07-21T18:15Z
Repository: https://github.com/strukturag/libheif
Language: C++
Files changed: libheif/heif_context.cc
Commit date: 2019-08-02 14:54:39 +0200
Commit message: Handle case where referenced "iref" box doesn't exist (fixes #138).

Diff: diff --git a/fuzzing/corpus/github_138.heic b/fuzzing/corpus/github_138.heic
new file mode 100644
index 0000000..75fdc97
Binary files /dev/null and b/fuzzing/corpus/github_138.heic differ
diff --git a/libheif/heif_context.cc b/libheif/heif_context.cc
index b5dabd6..decbe83 100644
--- a/libheif/heif_context.cc
+++ b/libheif/heif_context.cc
@@ -811,10 +811,16 @@ Error HeifContext::get_id_of_non_virtual_child_image(heif_item_id id, heif_item_
   std::string image_type = m_heif_file->get_item_type(id);
   if (image_type=="grid" ||
       image_type=="iden" ||
       image_type=="iovl") {
     auto iref_box = m_heif_file->get_iref_box();
+    if (!iref_box) {
+      return Error(heif_error_Invalid_input,
+                   heif_suberror_No_item_data,
+                   "Derived image does not reference any other image items");
+    }
+
     std::vector<heif_item_id> image_references = iref_box->get_references(id, fourcc("dimg"));
 
     // TODO: check whether this really can be recursive (e.g. overlay of grid images)
 
     if (image_references.empty()) {

Fixed code:     if (!iref_box) {
      return Error(heif_error_Invalid_input,
                   heif_suberror_No_item_data,
                   "Derived image does not reference any other image items");
    }
CVE-2017-15538: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-10-17T20:29Z
Repository: https://github.com/ILIAS-eLearning/ILIAS
Language: PHP
Files changed: Services/MediaObjects/classes/class.ilMediaItem.php
Commit date: 2017-10-11 15:08:52 +0200
Commit message: fixed bug #0021435

Diff: diff --git a/Services/MediaObjects/classes/class.ilMediaItem.php b/Services/MediaObjects/classes/class.ilMediaItem.php
index 68555e7367..e6eee8faa7 100755
--- a/Services/MediaObjects/classes/class.ilMediaItem.php
+++ b/Services/MediaObjects/classes/class.ilMediaItem.php
@@ -669,11 +669,14 @@ class ilMediaItem
 	* @param	string	$a_name		parameter name
 	* @param	string	$a_value	parameter value
 	*/
 	function setParameter($a_name, $a_value)
 	{
-		$this->parameters[$a_name] = $a_value;
+		if ($this->checkParameter($a_name, $a_value))
+		{
+			$this->parameters[$a_name] = $a_value;
+		}
 	}
 
 	/**
 	* reset parameters
 	*/
@@ -698,10 +701,38 @@ class ilMediaItem
 				$this->setParameter($par, $val);
 			}
 		}
 	}
 
+	/**
+	 * Check parameter (filter javascript related and other unsafe parameters/values)
+	 *
+	 * @param string $a_par parameter
+	 * @param string $a_val value
+	 * @return bool
+	 */
+	function checkParameter($a_par, $a_val)
+	{
+		// do not allow event attributes
+		if (substr(strtolower(trim($a_par)), 0, 2) == "on")
+		{
+			return false;
+		}
+		// no javascript in value
+		if (is_int(strpos(strtolower($a_val), "javascript")))
+		{
+			return false;
+		}
+		// do not allow to change the src attribute
+		if (in_array(strtolower(trim($a_par)), array("src")))
+		{
+			return false;
+		}
+
+		return true;
+	}
+
 
 	/**
 	* get all parameters (in array)
 	*/
 	function getParameters()

Vulnerable code: 		$this->parameters[$a_name] = $a_value;
Fixed code: 		if ($this->checkParameter($a_name, $a_value))
		{
			$this->parameters[$a_name] = $a_value;
		}
	/**
	 * Check parameter (filter javascript related and other unsafe parameters/values)
	 *
	 * @param string $a_par parameter
	 * @param string $a_val value
	 * @return bool
	 */
	function checkParameter($a_par, $a_val)
	{
		// do not allow event attributes
		if (substr(strtolower(trim($a_par)), 0, 2) == "on")
		{
			return false;
		}
		// no javascript in value
		if (is_int(strpos(strtolower($a_val), "javascript")))
		{
			return false;
		}
		// do not allow to change the src attribute
		if (in_array(strtolower(trim($a_par)), array("src")))
		{
			return false;
		}

		return true;
	}
CVE-2023-32076: Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
value: in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.
CWE description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CVSS v3 base score: 5.5
Published: 2023-05-10T18:15Z
Repository: https://github.com/in-toto/in-toto
Language: Unknown
Commit date: 2023-05-10 13:34:44 -0400
Commit message: Merge pull request from GHSA-wc64-c5rv-32pf

Drop user_settings module
CVE-2015-0876: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-04-07T02:00Z
Repository: https://github.com/sauruscms/Saurus-CMS-Community-Edition
Language: PHP
Files changed: classes/adminpage.inc.php
Commit date: 2015-01-27 21:09:15 +0100
Commit message: Fix stored and reflected XSS vulnerabilities

as described in VN: JVN#18387086 / TN: JPCERT#95011159 advisory.

Diff: diff --git a/classes/adminpage.inc.php b/classes/adminpage.inc.php
index f6a1d9f..ee99b86 100644
--- a/classes/adminpage.inc.php
+++ b/classes/adminpage.inc.php
@@ -300,10 +300,12 @@ function print_language_selectbox() {
 
 	?>
     <table border="0" cellspacing="0" cellpadding="1">
 	<form name="languageform" method=get>
 	<? foreach($site->fdat as $fdat_field=>$fdat_value) {
+		$fdat_value = htmlspecialchars(xss_clean($fdat_value));
+		$fdat_field = htmlspecialchars(xss_clean($fdat_field)); 
 		if($fdat_field != 'flt_keel') {?>
 		<input type=hidden name="<?=$fdat_field?>" value="<?=$fdat_value?>">
 	<?	}
 	}?>
 	<?php if($sth->rows > 1) { ?>

Fixed code: 		$fdat_value = htmlspecialchars(xss_clean($fdat_value));
		$fdat_field = htmlspecialchars(xss_clean($fdat_field));
CVE-2021-28855: NULL Pointer Dereference (CWE-476)
value: In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-14T17:15Z
Repository: https://github.com/jsummers/deark
Language: C
Files changed: modules/pict.c
Commit date: 2021-03-12 15:13:19 -0500
Commit message: pict: Fixed a bug with ICC profile extraction

Could cause a NULL pointer dereference.

Found by F. Çelik.

Diff: diff --git a/modules/pict.c b/modules/pict.c
index 4e4fb02f..c05b8d79 100644
--- a/modules/pict.c
+++ b/modules/pict.c
@@ -658,10 +658,15 @@ static void do_iccprofile_item(deark *c, lctx *d, i64 pos, i64 len)
 	}
 
 	if(selector==0 || selector==1) {
 		// Beginning and Continuation segments normally have profile data.
 		// End segments (selector==2) are not allowed to include data.
+
+		if(!d->iccprofile_file) {
+			de_warn(c, "Bad ICC profile segment");
+			return;
+		}
 		dbuf_copy(c->infile, pos+4, data_len, d->iccprofile_file);
 	}
 }
 
 // ShortComment

Fixed code: 
		if(!d->iccprofile_file) {
			de_warn(c, "Bad ICC profile segment");
			return;
		}
CVE-2021-28856: Divide By Zero (CWE-369)
value: In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the value of pixelsize.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2021-04-14T17:15Z
Repository: https://github.com/jsummers/deark
Language: C
Files changed: src/fmtutil.c
Commit date: 2021-03-14 10:09:11 -0400
Commit message: pict,macrsrc: Fixed a bug that could cause division by 0

Found by F. Çelik.

Diff: diff --git a/src/fmtutil.c b/src/fmtutil.c
index f7e9ac1b..ab728413 100644
--- a/src/fmtutil.c
+++ b/src/fmtutil.c
@@ -1616,11 +1616,13 @@ void fmtutil_macbitmap_read_pixmap_only_fields(deark *c, dbuf *f, struct fmtutil
 	bi->cmpcount = dbuf_getu16be(f, pos+20);
 	bi->cmpsize = dbuf_getu16be(f, pos+22);
 	de_dbg(c, "pixel type=%d, bits/pixel=%d, components/pixel=%d, bits/comp=%d",
 		(int)bi->pixeltype, (int)bi->pixelsize, (int)bi->cmpcount, (int)bi->cmpsize);
 
-	bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize;
+	if(bi->pixelsize>0) {
+		bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize;
+	}
 	if(bi->pdwidth < bi->npwidth) {
 		bi->pdwidth = bi->npwidth;
 	}
 
 	plane_bytes = dbuf_getu32be(f, pos+24);

Vulnerable code: 	bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize;
Fixed code: 	if(bi->pixelsize>0) {
		bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize;
	}
CVE-2021-32693: Improper Authentication (CWE-287)
value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.8
Published: 2021-06-17T23:15Z
Repository: https://github.com/symfony/security-http
Language: Unknown
Commit date: 2021-06-17 15:35:32 +0200
Commit message: security #cve-2021-32693 [SecurityHttp] Fix "Authentication granted with multiple firewalls" (wouterj)

This PR was merged into the 5.3 branch.
CVE-2020-12827: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.2
Published: 2020-06-17T14:15Z
Repository: https://github.com/mjmlio/mjml
Language: JavaScript
Files changed: packages/mjml-core/src/index.js
Commit date: 2020-05-05 17:04:29 +0200
Commit message: expose ignoreIncludes on mjml2html

Diff: diff --git a/packages/mjml-core/src/index.js b/packages/mjml-core/src/index.js
index 9bc466aa..039b956f 100644
--- a/packages/mjml-core/src/index.js
+++ b/packages/mjml-core/src/index.js
@@ -80,10 +80,11 @@ export default function mjml2html(mjml, options = {}) {
       Ubuntu: 'https://fonts.googleapis.com/css?family=Ubuntu:300,400,500,700',
     },
     keepComments,
     minify = false,
     minifyOptions = {},
+    ignoreIncludes = false,
     juiceOptions = {},
     juicePreserveTags = null,
     skeleton = defaultSkeleton,
     validationLevel = 'soft',
     filePath = '.',
@@ -100,10 +101,11 @@ export default function mjml2html(mjml, options = {}) {
       keepComments,
       components,
       filePath,
       actualPath,
       preprocessors,
+      ignoreIncludes,
     })
   }
 
   mjml = handleMjml3(mjml, { noMigrateWarn })
 

Fixed code:     ignoreIncludes = false,
      ignoreIncludes,
CVE-2023-27587: Generation of Error Message Containing Sensitive Information (CWE-209)
value: ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google Cloud TTS request, then it will include the full URL of the request. The request URL contains the Google Cloud API key. This has been patched in commit 8533b01. Upgrading should be accompanied by deleting the current GCP API key and issuing a new one. There are no known workarounds.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 6.5
Published: 2023-03-13T22:15Z
Repository: https://github.com/rozbb/readtomyshoe
Language: Rust
Files changed: server/src/tts.rs
Commit date: 2023-03-13 14:18:14 -0400
Commit message: Fixed leakage of GCP API key through TTS error message

Diff: diff --git a/server/src/tts.rs b/server/src/tts.rs
index c47a7b2..4a5964f 100644
--- a/server/src/tts.rs
+++ b/server/src/tts.rs
@@ -83,10 +83,18 @@ pub(crate) fn get_api_key() -> Result<String, AnyError> {
             e,
         )
     })
 }
 
+/// Redacts the API key out of the TTS error message
+fn redact_error(mut e: reqwest::Error) -> reqwest::Error {
+    // The API key is specified by `?key=...`. Overwriting the query section of the URL will make
+    // this go away
+    e.url_mut().map(|u| u.set_query(Some("key=REDACTED")));
+    e
+}
+
 /// Speaks text string of length at most MAX_CHARS_PER_REQUEST. Returns an error if length exceeds,
 /// or an error occurs in the Google Cloud API call.
 pub(crate) async fn tts_single(api_key: &str, req: &TtsRequest) -> Result<Bytes, AnyError> {
     let payload = req.into_json();
 
@@ -104,10 +112,11 @@ pub(crate) async fn tts_single(api_key: &str, req: &TtsRequest) -> Result<Bytes,
         .json(&payload)
         .send()
         .await
         .with_context(|| "Couldn't make TTS request")?
         .error_for_status()
+        .map_err(redact_error)
         .with_context(|| "TTS request failed")?;
 
     // The resulting JSON response has our MP3 data
     let res_bytes = res.bytes().await?;
     let audio_response: AudioResponse = serde_json::from_slice(&res_bytes)?;

Fixed code: /// Redacts the API key out of the TTS error message
fn redact_error(mut e: reqwest::Error) -> reqwest::Error {
    // The API key is specified by `?key=...`. Overwriting the query section of the URL will make
    // this go away
    e.url_mut().map(|u| u.set_query(Some("key=REDACTED")));
    e
}

        .map_err(redact_error)
CVE-2021-46249: Authorization Bypass Through User-Controlled Key (CWE-639)
value: An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 6.5
Published: 2022-02-15T23:15Z
Repository: https://github.com/ScratchVerifier/ScratchOAuth2
Language: PHP
Files changed: includes/api/SpecificApps.php
Commit date: 2021-04-12 20:43:36 +0900
Commit message: SECURITY: Deny modification of flags using REST API
Authorization bypass by user-controlled key in SpecificApps REST API in 
ScratchOAuth2 allows app owners to set flags that indicate whether an 
app is verified on their own apps.

Diff: diff --git a/includes/api/SpecificApps.php b/includes/api/SpecificApps.php
index cc4edc8..f471e17 100644
--- a/includes/api/SpecificApps.php
+++ b/includes/api/SpecificApps.php
@@ -36,10 +36,12 @@ class SpecificApps extends SimpleHandler {
 	}
 	private function patch( int $client_id, int $owner_id ) {
 		$data = $this->getRequest()->getBody()->getContents();
 		$data = json_decode($data, true);
 		if (!$data) return $this->http400();
+		// Users may not modify flags, thus 403
+		if (array_key_exists('flags', $data)) return $this->getResponseFactory()->createHttpError(403);
 		if (
 			array_key_exists('reset_secret', $data)
 			&& !is_bool($data['reset_secret'])
 		) return $this->http400();
 		if (

Fixed code: 		// Users may not modify flags, thus 403
		if (array_key_exists('flags', $data)) return $this->getResponseFactory()->createHttpError(403);
CVE-2021-46250: Insufficient Information (NVD-CWE-noinfo)
value: An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 10
Published: 2022-02-15T23:15Z
Repository: https://github.com/ScratchVerifier/ScratchOAuth2
Language: PHP
Files changed: includes/common/login.php
Commit date: 2021-04-12 20:37:19 +0900
Commit message: SECURITY: Use strict comparison when authenticating
Incorrect comparison (autocasting) in SOA2Login::commented in 
ScratchOAuth2 allows unprivileged attackers to authorize as other users 
on downstream components that rely on ScratchOAuth2, as demonstrated by 
"1234567890" and "123456789e1".

Diff: diff --git a/includes/common/login.php b/includes/common/login.php
index d5fdcbf..06fa792 100644
--- a/includes/common/login.php
+++ b/includes/common/login.php
@@ -50,11 +50,11 @@ class SOA2Login {
 		// Step 20, 21
 		$comments = file_get_contents(sprintf(SOA2_COMMENTS_API, $username, rand()));
 		$matches = [];
 		preg_match_all(SOA2_COMMENTS_REGEX, $comments, $matches, PREG_PATTERN_ORDER);
 		for ($i = 0; $i < count($matches[0]); ++$i) {
-			if (strtolower($matches[1][$i]) != $username) continue;
+			if (strtolower($matches[1][$i]) !== $username) continue;
 			if (hash_equals($code, $matches[2][$i])) return true; // Step 22
 		}
 		return false;
 	}
 	/**

Vulnerable code: 			if (strtolower($matches[1][$i]) != $username) continue;
Fixed code: 			if (strtolower($matches[1][$i]) !== $username) continue;
CVE-2021-46251: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-15T23:15Z
Repository: https://github.com/ScratchVerifier/ScratchOAuth2
Language: PHP
Files changed: includes/special/SpecialScratchOAuth2.php
Commit date: 2021-04-12 20:52:03 +0900
Commit message: SECURITY: Escape username in invalid username error
POST request with invalid usernames to SpecialScratchOAuth2 page in 
ScratchOAuth2 may lead to reflected cross-site scripting.

Diff: diff --git a/includes/special/SpecialScratchOAuth2.php b/includes/special/SpecialScratchOAuth2.php
index 4edb1dd..b638d31 100644
--- a/includes/special/SpecialScratchOAuth2.php
+++ b/includes/special/SpecialScratchOAuth2.php
@@ -67,11 +67,11 @@ class SpecialScratchOAuth2 extends SpecialPage {
 			$request->wasPosted() && $request->getCheck( 'username' )
 		) {
 			$username = $request->getVal( 'username', '', );
 			if (!preg_match(SOA2_USERNAME_REGEX, $username)) {
 				$this->specialLogin(
-					wfMessage('soa2-invalid-username', $username)->plain()
+					wfMessage('soa2-invalid-username')->plaintextParams($username)->parse()
 				);
 				return;
 			}
 			if ($request->getCheck( 'token' )) {
 				$this->doLogin( $request );

Vulnerable code: 					wfMessage('soa2-invalid-username', $username)->plain()
Fixed code: 					wfMessage('soa2-invalid-username')->plaintextParams($username)->parse()
CVE-2013-2012: Improper Privilege Management (CWE-269)
value: autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.3
Published: 2019-10-31T20:15Z
Repository: https://github.com/wting/autojump
Language: Shell
Files changed: bin/autojump, bin/autojump.sh, install.sh
Commit date: 2013-04-24 19:05:56 -0500
Commit message: better fix for custom installation directories

Diff: diff --git a/bin/autojump b/bin/autojump
index 9d145b9..819535a 100755
--- a/bin/autojump
+++ b/bin/autojump
@@ -32,11 +32,11 @@ except ImportError:
 from operator import itemgetter
 import re
 import shutil
 from tempfile import NamedTemporaryFile
 
-VERSION = 'release-v21.5.6'
+VERSION = 'release-v21.5.7'
 MAX_KEYWEIGHT = 1000
 MAX_STORED_PATHS = 1000
 COMPLETION_SEPARATOR = '__'
 ARGS = None
 
diff --git a/bin/autojump.sh b/bin/autojump.sh
index 528e49a..f631d95 100644
--- a/bin/autojump.sh
+++ b/bin/autojump.sh
@@ -13,9 +13,9 @@ elif [ -s ~/.autojump/etc/profile.d/autojump.${shell} ]; then
 # check global install
 elif [ -s /etc/profile.d/autojump.${shell} ]; then
 	source /etc/profile.d/autojump.${shell}
 
 # check custom install locations (modified by Homebrew or using --destdir option)
-elif [ -s /destdir_${RANDOM}_install/autojump.${shell} ]; then
-	source /destdir_${RANDOM}_install/autojump.${shell}
+#custom#	elif [ -s destdir_install/autojump.${shell} ]; then
+#custom#		source destdir_install/autojump.${shell}
 
 fi
diff --git a/install.sh b/install.sh
index 58abc53..259970d 100755
--- a/install.sh
+++ b/install.sh
@@ -220,11 +220,12 @@ mkdir -p ${destdir}${zshsharedir} || exit 1
 # TODO: remove unused _j function (2013.02.01_1348, ting)
 install -v -m 0755 ./bin/_j ${destdir}${zshsharedir} || exit 1
 
 # MODIFY AUTOJUMP.SH FOR CUSTOM INSTALLS
 if [[ -z ${local} ]] && [[ -z ${global} ]]; then
-    sed -i "s:/destdir_.*_install:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
+    sed -i "s:#custom#\t::g" ${destdir}etc/profile.d/autojump.sh
+    sed -i "s:destdir_install\t:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
 fi
 
 # DISPLAY ADD MESSAGE
 rc_file="~/.${shell}rc"
 if [[ `uname` == "Darwin" ]] && [[ ${shell} == "bash" ]]; then

Vulnerable code: VERSION = 'release-v21.5.6'
elif [ -s /destdir_${RANDOM}_install/autojump.${shell} ]; then
	source /destdir_${RANDOM}_install/autojump.${shell}
    sed -i "s:/destdir_.*_install:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
Fixed code: VERSION = 'release-v21.5.7'
#custom#	elif [ -s destdir_install/autojump.${shell} ]; then
#custom#		source destdir_install/autojump.${shell}
    sed -i "s:#custom#\t::g" ${destdir}etc/profile.d/autojump.sh
    sed -i "s:destdir_install\t:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
CVE-2013-2012: Improper Privilege Management (CWE-269)
value: autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.3
Published: 2019-10-31T20:15Z
Repository: https://github.com/wting/autojump
Language: Shell
Files changed: bin/autojump, bin/autojump.sh, install.sh
Commit date: 2013-04-24 15:34:53 -0500
Commit message: Fix security bug that allows running arbitrary user code.

https://bugzilla.redhat.com/show_bug.cgi?id=950777

Diff: diff --git a/bin/autojump b/bin/autojump
index 03e1885..9d145b9 100755
--- a/bin/autojump
+++ b/bin/autojump
@@ -32,11 +32,11 @@ except ImportError:
 from operator import itemgetter
 import re
 import shutil
 from tempfile import NamedTemporaryFile
 
-VERSION = 'release-v21.5.5'
+VERSION = 'release-v21.5.6'
 MAX_KEYWEIGHT = 1000
 MAX_STORED_PATHS = 1000
 COMPLETION_SEPARATOR = '__'
 ARGS = None
 
diff --git a/bin/autojump.sh b/bin/autojump.sh
index d434ed5..528e49a 100644
--- a/bin/autojump.sh
+++ b/bin/autojump.sh
@@ -13,9 +13,9 @@ elif [ -s ~/.autojump/etc/profile.d/autojump.${shell} ]; then
 # check global install
 elif [ -s /etc/profile.d/autojump.${shell} ]; then
 	source /etc/profile.d/autojump.${shell}
 
 # check custom install locations (modified by Homebrew or using --destdir option)
-elif [ -s custom_install/autojump.${shell} ]; then
-	source custom_install/autojump.${shell}
+elif [ -s /destdir_${RANDOM}_install/autojump.${shell} ]; then
+	source /destdir_${RANDOM}_install/autojump.${shell}
 
 fi
diff --git a/install.sh b/install.sh
index 498031c..58abc53 100755
--- a/install.sh
+++ b/install.sh
@@ -220,11 +220,11 @@ mkdir -p ${destdir}${zshsharedir} || exit 1
 # TODO: remove unused _j function (2013.02.01_1348, ting)
 install -v -m 0755 ./bin/_j ${destdir}${zshsharedir} || exit 1
 
 # MODIFY AUTOJUMP.SH FOR CUSTOM INSTALLS
 if [[ -z ${local} ]] && [[ -z ${global} ]]; then
-    sed -i "s:custom_install:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
+    sed -i "s:/destdir_.*_install:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
 fi
 
 # DISPLAY ADD MESSAGE
 rc_file="~/.${shell}rc"
 if [[ `uname` == "Darwin" ]] && [[ ${shell} == "bash" ]]; then

Vulnerable code: VERSION = 'release-v21.5.5'
elif [ -s custom_install/autojump.${shell} ]; then
	source custom_install/autojump.${shell}
    sed -i "s:custom_install:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
Fixed code: VERSION = 'release-v21.5.6'
elif [ -s /destdir_${RANDOM}_install/autojump.${shell} ]; then
	source /destdir_${RANDOM}_install/autojump.${shell}
    sed -i "s:/destdir_.*_install:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
CVE-2022-31094: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ScratchTools is a web extension designed to make interacting with the Scratch programming language community (Scratching) easier. In affected versions anybody who uses the Recently Viewed Projects feature is vulnerable to having their account taken over if they view a project that tries to. The issue is that if a user visits a project that includes Javascript in the title, then when the Recently Viewed Projects feature displays it, it could run the Javascript. This issue has been addressed in the 2.5.2 release. Users having issues scratching should open an issue in the project issue tracker https://github.com/STForScratch/ScratchTools/
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-06-27T21:15Z
Repository: https://github.com/STForScratch/ScratchTools
Language: Unknown
Commit date: 2022-06-20 11:31:34 -0700
Commit message: Merge pull request #55 from STForScratch/fix-project-recently-viewed-security-issue

Fix Security Bug with Recently Viewed Projects
CVE-2021-4250: Improper Resource Shutdown or Release (CWE-404)
value: A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2. This affects the function call of the file lib/active_attr/typecasting/boolean_typecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit has been disclosed to the public and may be used. Upgrading to version 0.15.3 is able to address this issue. The name of the patch is dab95e5843b01525444b82bd7b336ef1d79377df. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216207.
CWE description: The product does not release or incorrectly releases a resource before it is made available for re-use.
CVSS v3 base score: 7.5
Published: 2022-12-18T22:15Z
Repository: https://github.com/cgriego/active_attr
Language: Ruby
Files changed: lib/active_attr/typecasting/boolean_typecaster.rb
Commit date: 2021-04-12 16:06:15 -0500
Commit message: fix ReDoS vulnerability (#185)

resolve https://github.com/cgriego/active_attr/issues/184

Co-authored-by: wonda-tea-coffee <rikita.ishikawa@crowdworks.co.jp>
Diff: diff --git a/lib/active_attr/typecasting/boolean_typecaster.rb b/lib/active_attr/typecasting/boolean_typecaster.rb
index 8b84102..5250ca8 100644
--- a/lib/active_attr/typecasting/boolean_typecaster.rb
+++ b/lib/active_attr/typecasting/boolean_typecaster.rb
@@ -40,11 +40,11 @@ module ActiveAttr
       # @since 0.5.0
       def call(value)
         case value
         when *FALSE_VALUES then false
         when *NIL_VALUES then nil
-        when Numeric, /\A[-+]?(0+\.?0*|0*\.?0+)\z/ then !value.to_f.zero?
+        when Numeric, /\A[-+]?(0++\.?0*|0*+\.?0+)\z/ then !value.to_f.zero?
         else value.present?
         end
       end
     end
   end

Vulnerable code:         when Numeric, /\A[-+]?(0+\.?0*|0*\.?0+)\z/ then !value.to_f.zero?
Fixed code:         when Numeric, /\A[-+]?(0++\.?0*|0*+\.?0+)\z/ then !value.to_f.zero?
CVE-2020-11073: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious `.venv` file could run arbitrary code without any user interaction. This is fixed in version: 1.16.0
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.8
Published: 2020-05-13T19:15Z
Repository: https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv
Language: Unknown
Commit date: 2020-01-07 20:29:24 +0000
Commit message: Merge pull request #123 from MichaelAquilina/fix/insecure_activation

fix: insecure activation of virtualenvs