Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-1900: Use After Free (CWE-416)
value: When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2021-03-11T01:15Z
Repository: https://github.com/facebook/hhvm
Language: C++
Files changed: hphp/runtime/base/object-data.cpp, hphp/runtime/base/variable-unserializer.cpp
Commit date: 2020-06-30 16:27:28 -0700
Commit message: CVE-2020-1900

Pre-reserve object dynamic properties when unserializing

Diff: diff --git a/hphp/runtime/base/object-data.cpp b/hphp/runtime/base/object-data.cpp
index 34a1b8174cac..77ae2ad19d90 100644
--- a/hphp/runtime/base/object-data.cpp
+++ b/hphp/runtime/base/object-data.cpp
@@ -340,10 +340,15 @@ void ObjectData::reserveDynProps(int numDynamic) {
 Array& ObjectData::reserveProperties(int numDynamic /* = 2 */) {
   if (getAttribute(HasDynPropArr)) {
     return dynPropArray();
   }
 
+  auto const allocsz = MixedArray::computeAllocBytesFromMaxElms(numDynamic);
+  if (UNLIKELY(allocsz > kMaxSmallSize && tl_heap->preAllocOOM(allocsz))) {
+    check_non_safepoint_surprise();
+  }
+
   return setDynPropArray(
       Array::attach(MixedArray::MakeReserveMixed(numDynamic))
   );
 }
 
diff --git a/hphp/runtime/base/variable-unserializer.cpp b/hphp/runtime/base/variable-unserializer.cpp
index c03843bc9fed..4789857137be 100644
--- a/hphp/runtime/base/variable-unserializer.cpp
+++ b/hphp/runtime/base/variable-unserializer.cpp
@@ -550,10 +550,11 @@ void VariableUnserializer::unserializeProp(ObjectData* obj,
 
   if (slot == kInvalidSlot || !lookup.accessible) {
     // Unserialize as a dynamic property. If this is the first, we need to
     // pre-allocate space in the array to ensure the elements don't move during
     // unserialization.
+    obj->reserveDynProps(nProp);
     t = obj->makeDynProp(realKey.get());
   } else {
     // We'll check if this doesn't violate the type-hint once we're done
     // unserializing all the props.
     t = obj->getPropLval(ctx, key.get());

Fixed code:   auto const allocsz = MixedArray::computeAllocBytesFromMaxElms(numDynamic);
  if (UNLIKELY(allocsz > kMaxSmallSize && tl_heap->preAllocOOM(allocsz))) {
    check_non_safepoint_surprise();
  }

    obj->reserveDynProps(nProp);
CVE-2022-36937: Insufficient Information (NVD-CWE-noinfo)
value: HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3.

Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-05-10T19:15Z
Repository: https://github.com/facebook/hhvm
Language: C++
Files changed: hphp/runtime/base/ssl-socket.cpp
Commit date: 2023-01-20 11:23:07 -0800
Commit message: [security] Disable TLS 1.0 in stream extension URLs

The stream extension has the functions `stream_socket_server` and
`stream_socket_client` which accept URLs. When a URL starts with
`tls://` it would previously allow TLS 1.0 connections.

TLS 1.0 is deprecated and considered insecure.

Diff: diff --git a/hphp/runtime/base/ssl-socket.cpp b/hphp/runtime/base/ssl-socket.cpp
index c08564bba3a4..6b533eccc940 100644
--- a/hphp/runtime/base/ssl-socket.cpp
+++ b/hphp/runtime/base/ssl-socket.cpp
@@ -497,11 +497,11 @@ bool SSLSocket::setupCrypto(SSLSocket *session /* = NULL */) {
     m_data->m_client = true;
     smethod = SSLv23_client_method();
     break;
   case CryptoMethod::ClientTLS:
     m_data->m_client = true;
-    smethod = TLSv1_client_method();
+    smethod = TLS_client_method();
     break;
   case CryptoMethod::ServerSSLv23:
     m_data->m_client = false;
     smethod = SSLv23_server_method();
     break;
@@ -540,11 +540,11 @@ bool SSLSocket::setupCrypto(SSLSocket *session /* = NULL */) {
   break;
 #endif
 
   case CryptoMethod::ServerTLS:
     m_data->m_client = false;
-    smethod = TLSv1_server_method();
+    smethod = TLS_server_method();
     break;
   default:
     return false;
   }
 

Vulnerable code:     smethod = TLSv1_client_method();
    smethod = TLSv1_server_method();
Fixed code:     smethod = TLS_client_method();
    smethod = TLS_server_method();
CVE-2021-43778: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2021-11-24T19:15Z
Repository: https://github.com/pluginsGLPI/barcode
Language: PHP
Files changed: front/send.php
Commit date: 2021-11-08 11:27:27 +0100
Commit message: die on insecure file request, fix #85

Diff: diff --git a/front/send.php b/front/send.php
index 2dc8c86..937c971 100644
--- a/front/send.php
+++ b/front/send.php
@@ -52,10 +52,11 @@ if (isset($_GET['file'])) {
    // Security test : document in $docDir
    if (strstr($filename, "../") || strstr($filename, "..\\")) {
       echo "Security attack !!!";
       Toolbox::logDebug("[Plugin barcode][security][sendfile] ".
                $_SESSION["glpiname"]." try to get a non standard file : ".$filename);
+      exit;
    }
 
    $file = $docDir.'/'.$filename;
    if (!file_exists($file)) {
       echo "Error file $filename does not exist"; //TODO : traduire

Fixed code:       exit;
CVE-2020-7688: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 7.8
Published: 2020-07-01T17:15Z
Repository: https://github.com/mikaelbr/mversion
Language: JavaScript
Files changed: lib/git.js
Commit date: 2020-06-23 17:02:33 -0500
Commit message: Fix Remote Command Execution

Diff: diff --git a/lib/git.js b/lib/git.js
index acf6297..2a488ff 100644
--- a/lib/git.js
+++ b/lib/git.js
@@ -59,11 +59,11 @@ module.exports.commit = function (files, message, newVer, tagName, callback) {
       cp.exec([gitApp, "commit", "-m", message].join(" "), gitExtra, done);
     },
 
     function (done) {
       cp.exec(
-        [gitApp, "tag", "-a", tagName, "-m", message].join(" "),
+        [gitApp, "tag", "-a", escapeQuotes(tagName), "-m", message].join(" "),
         gitExtra,
         done
       );
     },
   ];

Vulnerable code:         [gitApp, "tag", "-a", tagName, "-m", message].join(" "),
Fixed code:         [gitApp, "tag", "-a", escapeQuotes(tagName), "-m", message].join(" "),
CVE-2013-2174: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2013-07-31T13:20Z
Repository: https://github.com/bagder/curl
Language: C
Files changed: lib/escape.c
Commit date: 2013-06-22 11:21:35 +0200
Commit message: Curl_urldecode: no peeking beyond end of input buffer

Security problem: CVE-2013-2174

If a program would give a string like "%FF" to curl_easy_unescape() but
ask for it to decode only the first byte, it would still parse and
decode the full hex sequence. The function then not only read beyond the
allowed buffer but it would also deduct the *unsigned* counter variable
for how many more bytes there's left to read in the buffer by two,
making the counter wrap. Continuing this, the function would go on
reading beyond the buffer and soon writing beyond the allocated target
buffer...

Bug: http://curl.haxx.se/docs/adv_20130622.html
Reported-by: Timo Sirainen

Diff: diff --git a/lib/escape.c b/lib/escape.c
index 6a26cf8ef9..aa7db2c5b9 100644
--- a/lib/escape.c
+++ b/lib/escape.c
@@ -3,11 +3,11 @@
  *  Project                     ___| | | |  _ \| |
  *                             / __| | | | |_) | |
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
  * are also available at http://curl.haxx.se/docs/copyright.html.
  *
@@ -157,11 +157,12 @@ CURLcode Curl_urldecode(struct SessionHandle *data,
   if(!ns)
     return CURLE_OUT_OF_MEMORY;
 
   while(--alloc > 0) {
     in = *string;
-    if(('%' == in) && ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
+    if(('%' == in) && (alloc > 2) &&
+       ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
       /* this is two hexadecimal digits following a '%' */
       char hexstr[3];
       char *ptr;
       hexstr[0] = string[1];
       hexstr[1] = string[2];

Vulnerable code:  * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
    if(('%' == in) && ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
Fixed code:  * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
    if(('%' == in) && (alloc > 2) &&
       ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
CVE-2017-16003: Missing Encryption of Sensitive Data (CWE-311)
value: windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CWE description: The product does not encrypt sensitive or critical information before storage or transmission.
CVSS v3 base score: 8.1
Published: 2018-05-29T20:29Z
Repository: https://github.com/felixrieseberg/windows-build-tools
Language: JavaScript
Files changed: src/constants.js
Commit date: 2016-12-22 09:19:25 -0800
Commit message: :wrench: Use HTTPS - Thanks to @grander

Diff: diff --git a/src/constants.js b/src/constants.js
index a8e388c..bdba14c 100644
--- a/src/constants.js
+++ b/src/constants.js
@@ -1,10 +1,10 @@
 var pythonMirror = process.env.npm_config_python_mirror || process.env.PYTHON_MIRROR || 'https://www.python.org/ftp/python/'
 
 var buildTools = {
   installerName: 'BuildTools_Full.exe',
-  installerUrl: 'http://download.microsoft.com/download/5/f/7/5f7acaeb-8363-451f-9425-68a90f98b238/visualcppbuildtools_full.exe',
+  installerUrl: 'https://download.microsoft.com/download/5/f/7/5f7acaeb-8363-451f-9425-68a90f98b238/visualcppbuildtools_full.exe',
   logName: 'build-tools-log.txt'
 }
 
 var python = {
   installerName: 'python-2.7.11.msi',

Vulnerable code:   installerUrl: 'http://download.microsoft.com/download/5/f/7/5f7acaeb-8363-451f-9425-68a90f98b238/visualcppbuildtools_full.exe',
Fixed code:   installerUrl: 'https://download.microsoft.com/download/5/f/7/5f7acaeb-8363-451f-9425-68a90f98b238/visualcppbuildtools_full.exe',
CVE-2021-4308: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in WebPA up to 3.1.1. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. Upgrading to version 3.1.2 is able to address this issue. The identifier of the patch is 8836c4f549181e885a68e0e7ca561fdbcbd04bf0. It is recommended to upgrade the affected component. The identifier VDB-217637 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-08T10:15Z
Repository: https://github.com/WebPA/WebPA
Language: Unknown
Commit date: 2021-04-22 12:56:26 +0100
Commit message: Merge pull request #87 from Sephster/fix-sql-injection-attack

Security Fix
CVE-2012-5622: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-site request forgery (CSRF) vulnerability in the management console (openshift-console/app/controllers/application_controller.rb) in OpenShift 0.0.5 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Published: 2012-12-18T01:55Z
Repository: https://github.com/openshift/origin-server
Language: Ruby
Files changed: openshift-console/app/controllers/application_controller.rb
Commit date: 2012-12-03 16:46:59 -0500
Commit message: BZ878754 No CSRF attack protection in console

Diff: diff --git a/openshift-console/app/controllers/application_controller.rb b/openshift-console/app/controllers/application_controller.rb
index 311a8750..e170f1ad 100644
--- a/openshift-console/app/controllers/application_controller.rb
+++ b/openshift-console/app/controllers/application_controller.rb
@@ -1,5 +1,10 @@
 class ApplicationController < ActionController::Base
   include Console::Rescue
 
   protect_from_forgery
+
+  protected
+    def handle_unverified_request
+      raise Console::AccessDenied, "Request authenticity token does not match session #{session.inspect}"
+    end
 end

Fixed code: 
  protected
    def handle_unverified_request
      raise Console::AccessDenied, "Request authenticity token does not match session #{session.inspect}"
    end
CVE-2012-5646: Improper Input Validation (CWE-20)
value: node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATH_INFO.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-02-24T21:55Z
Repository: https://github.com/openshift/origin-server
Language: PHP
Files changed: node-util/www/html/restorer.php
Commit date: 2012-12-04 17:38:45 -0700
Commit message: Fix for Bug 880699

restorer.php security patch

Diff: diff --git a/node-util/www/html/restorer.php b/node-util/www/html/restorer.php
index 49694dcac..b1f66a947 100755
--- a/node-util/www/html/restorer.php
+++ b/node-util/www/html/restorer.php
@@ -1,10 +1,16 @@
 <?php
 
 list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]);
-shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
-
-sleep(2);
-$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
-header("Location: $url");
-
+if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
+    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
+    sleep(2);
+    $host = $_SERVER['HTTP_HOST'];
+    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
+    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
+    header("Location: $proto$host$url");
+} else {
+    // someone is trying to attack
+    error_log("Invalid uuid $uuid given to restorer.php");
+    header('HTTP/1.0 403 Forbidden');
+}
 ?>

Vulnerable code: shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");

sleep(2);
$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
header("Location: $url");

Fixed code: if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
    sleep(2);
    $host = $_SERVER['HTTP_HOST'];
    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
    header("Location: $proto$host$url");
} else {
    // someone is trying to attack
    error_log("Invalid uuid $uuid given to restorer.php");
    header('HTTP/1.0 403 Forbidden');
}
CVE-2012-5647: Improper Input Validation (CWE-20)
value: Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the PATH_INFO.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-02-24T21:55Z
Repository: https://github.com/openshift/origin-server
Language: PHP
Files changed: node-util/www/html/restorer.php
Commit date: 2012-12-04 17:38:45 -0700
Commit message: Fix for Bug 880699

restorer.php security patch

Diff: diff --git a/node-util/www/html/restorer.php b/node-util/www/html/restorer.php
index 49694dcac..b1f66a947 100755
--- a/node-util/www/html/restorer.php
+++ b/node-util/www/html/restorer.php
@@ -1,10 +1,16 @@
 <?php
 
 list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]);
-shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
-
-sleep(2);
-$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
-header("Location: $url");
-
+if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
+    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
+    sleep(2);
+    $host = $_SERVER['HTTP_HOST'];
+    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
+    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
+    header("Location: $proto$host$url");
+} else {
+    // someone is trying to attack
+    error_log("Invalid uuid $uuid given to restorer.php");
+    header('HTTP/1.0 403 Forbidden');
+}
 ?>

Vulnerable code: shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");

sleep(2);
$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
header("Location: $url");

Fixed code: if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
    sleep(2);
    $host = $_SERVER['HTTP_HOST'];
    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
    header("Location: $proto$host$url");
} else {
    // someone is trying to attack
    error_log("Invalid uuid $uuid given to restorer.php");
    header('HTTP/1.0 403 Forbidden');
}
CVE-2013-4561: Exposure of Resource to Wrong Sphere (CWE-668)
value: In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 9.1
Published: 2022-06-30T19:15Z
Repository: https://github.com/openshift/origin-server
Language: Other
Files changed: plugins/msg-node/mcollective/facts/openshift-facts
Commit date: 2013-11-12 14:21:23 -0500
Commit message: Bug 1022889 - AVC message is seen when mcolletive facts update cron job is running.

Looking back at the history showed that the switch to writing to /tmp/facts.log
was actually a mistake.  I'm reverting that change which will address this bug.

Diff: diff --git a/plugins/msg-node/mcollective/facts/openshift-facts b/plugins/msg-node/mcollective/facts/openshift-facts
index e42080dec..a0b22a5d8 100644
--- a/plugins/msg-node/mcollective/facts/openshift-facts
+++ b/plugins/msg-node/mcollective/facts/openshift-facts
@@ -4,6 +4,6 @@ PREFIX=""
 
 if [ -f /opt/rh/ruby193/root/usr/libexec/mcollective/update_yaml.rb ]; then
   PREFIX="/opt/rh/ruby193/root"
 fi
 
-oo-exec-ruby ${PREFIX}/usr/libexec/mcollective/update_yaml.rb ${PREFIX}/etc/mcollective/facts.yaml &> /tmp/facts.log
+oo-exec-ruby ${PREFIX}/usr/libexec/mcollective/update_yaml.rb ${PREFIX}/etc/mcollective/facts.yaml &> /dev/null

Vulnerable code: oo-exec-ruby ${PREFIX}/usr/libexec/mcollective/update_yaml.rb ${PREFIX}/etc/mcollective/facts.yaml &> /tmp/facts.log
Fixed code: oo-exec-ruby ${PREFIX}/usr/libexec/mcollective/update_yaml.rb ${PREFIX}/etc/mcollective/facts.yaml &> /dev/null
CVE-2021-3850: Improper Authentication (CWE-287)
value: Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.1
Published: 2022-01-25T15:15Z
Repository: https://github.com/adodb/adodb
Language: PHP
Files changed: drivers/adodb-postgres64.inc.php
Commit date: 2022-01-16 16:50:06 +0100
Commit message: Prevent auth bypass with PostgreSQL connections

Thanks to Emmet Leahy of Sorcery Ltd for reporting this vulnerability
(CVE-2021-3850).

This is a minimalistic approach to patch the issue, to reduce the risk
of causing regressions in the legacy stable branch.

Fixes #793

Diff: diff --git a/drivers/adodb-postgres64.inc.php b/drivers/adodb-postgres64.inc.php
index 27e06b06..c98ade9a 100644
--- a/drivers/adodb-postgres64.inc.php
+++ b/drivers/adodb-postgres64.inc.php
@@ -49,11 +49,10 @@ if (!defined('ADODB_DIR')) die();
 
 function adodb_addslashes($s)
 {
 	$len = strlen($s);
 	if ($len == 0) return "''";
-	if (strncmp($s,"'",1) === 0 && substr($s,$len-1) == "'") return $s; // already quoted
 
 	return "'".addslashes($s)."'";
 }
 
 class ADODB_postgres64 extends ADOConnection{

Vulnerable code: 	if (strncmp($s,"'",1) === 0 && substr($s,$len-1) == "'") return $s; // already quoted
CVE-2024-31216: Insufficient Information (NVD-CWE-noinfo)
value: The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-15T16:15Z
Repository: https://github.com/fluxcd/source-controller
Language: Unknown
Commit date: 2024-04-04 15:54:38 +0300
Commit message: Merge pull request #1430 from fluxcd/sanitze-bucker-errors

Sanitize URLs for bucket fetch error messages
CVE-2022-0219: Improper Restriction of XML External Entity Reference (CWE-611)
value: Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 5.5
Published: 2022-01-20T17:15Z
Repository: https://github.com/skylot/jadx
Language: Java
Files changed: jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java
Commit date: 2022-01-20 11:17:12 +0000
Commit message: fix: use secure xml parser for process manifest

Diff: diff --git a/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java b/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java
index e11ebb4f..8272bf3a 100644
--- a/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java
+++ b/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java
@@ -6,11 +6,10 @@
 import java.util.Arrays;
 import java.util.HashSet;
 import java.util.Set;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
@@ -22,10 +21,11 @@
 import jadx.core.dex.nodes.ClassNode;
 import jadx.core.dex.nodes.RootNode;
 import jadx.core.utils.exceptions.JadxRuntimeException;
 import jadx.core.utils.files.FileUtils;
 import jadx.core.xmlgen.ResContainer;
+import jadx.core.xmlgen.XmlSecurity;
 
 public class ExportGradleProject {
 
 	private static final Logger LOG = LoggerFactory.getLogger(ExportGradleProject.class);
 
@@ -137,11 +137,11 @@ private ApplicationParams getApplicationParams(Document androidManifest, Documen
 		return new ApplicationParams(appName, minSdk, targetSdk, versionCode, versionName);
 	}
 
 	private Document parseXml(String xmlContent) {
 		try {
-			DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder builder = XmlSecurity.getSecureDbf().newDocumentBuilder();
 			Document document = builder.parse(new InputSource(new StringReader(xmlContent)));
 
 			document.getDocumentElement().normalize();
 
 			return document;

Vulnerable code: import javax.xml.parsers.DocumentBuilderFactory;
			DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
Fixed code: import jadx.core.xmlgen.XmlSecurity;
			DocumentBuilder builder = XmlSecurity.getSecureDbf().newDocumentBuilder();
CVE-2022-0432: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 6.1
Published: 2022-02-02T22:15Z
Repository: https://github.com/mastodon/mastodon
Language: JavaScript
Files changed: public/embed.js
Commit date: 2022-02-01 17:34:48 +0100
Commit message: Fixed prototype pollution bug and only allow trusted origin (#17420)


Diff: diff --git a/public/embed.js b/public/embed.js
index dac507453..d597fd33c 100644
--- a/public/embed.js
+++ b/public/embed.js
@@ -13,11 +13,11 @@
     var iframes = [];
 
     window.addEventListener('message', function(e) {
       var data = e.data || {};
 
-      if (data.type !== 'setHeight' || !iframes[data.id]) {
+      if (data.type !== 'setHeight' || !iframes[data.id] || window.location.origin !== e.origin || data.id.toString() === '__proto__') {
         return;
       }
 
       iframes[data.id].height = data.height;
     });

Vulnerable code:       if (data.type !== 'setHeight' || !iframes[data.id]) {
Fixed code:       if (data.type !== 'setHeight' || !iframes[data.id] || window.location.origin !== e.origin || data.id.toString() === '__proto__') {
CVE-2023-42451: Use of Incorrectly-Resolved Name or Reference (CWE-706)
value: Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.
CWE description: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CVSS v3 base score: 7.5
Published: 2023-09-19T16:15Z
Repository: https://github.com/mastodon/mastodon
Language: Ruby
Files changed: app/lib/tag_manager.rb
Commit date: 2023-09-19 16:53:58 +0200
Commit message: Merge pull request from GHSA-v3xf-c9qf-j667


Diff: diff --git a/app/lib/tag_manager.rb b/app/lib/tag_manager.rb
index f1b61ff4fd6..c1bd2973ed1 100644
--- a/app/lib/tag_manager.rb
+++ b/app/lib/tag_manager.rb
@@ -5,22 +5,22 @@ require 'singleton'
 class TagManager
   include Singleton
   include RoutingHelper
 
   def web_domain?(domain)
-    domain.nil? || domain.delete('/').casecmp(Rails.configuration.x.web_domain).zero?
+    domain.nil? || domain.delete_suffix('/').casecmp(Rails.configuration.x.web_domain).zero?
   end
 
   def local_domain?(domain)
-    domain.nil? || domain.delete('/').casecmp(Rails.configuration.x.local_domain).zero?
+    domain.nil? || domain.delete_suffix('/').casecmp(Rails.configuration.x.local_domain).zero?
   end
 
   def normalize_domain(domain)
     return if domain.nil?
 
     uri = Addressable::URI.new
-    uri.host = domain.delete('/')
+    uri.host = domain.delete_suffix('/')
     uri.normalized_host
   end
 
   def local_url?(url)
     uri    = Addressable::URI.parse(url).normalize

Vulnerable code:     domain.nil? || domain.delete('/').casecmp(Rails.configuration.x.web_domain).zero?
    domain.nil? || domain.delete('/').casecmp(Rails.configuration.x.local_domain).zero?
    uri.host = domain.delete('/')
Fixed code:     domain.nil? || domain.delete_suffix('/').casecmp(Rails.configuration.x.web_domain).zero?
    domain.nil? || domain.delete_suffix('/').casecmp(Rails.configuration.x.local_domain).zero?
    uri.host = domain.delete_suffix('/')
CVE-2023-42452: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to execute in the browser. The impact is limited thanks to Mastodon's strict Content Security Policy, blocking inline scripts, etc. However a CSP bypass or loophole could be exploited to execute malicious XSS. Furthermore, it requires user interaction, as this can only occur upon clicking the “Translate” button on a malicious post. Versions 4.0.10, 4.2.8, and 4.2.0-rc2 contain a patch for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-19T16:15Z
Repository: https://github.com/mastodon/mastodon
Language: Ruby
Files changed: app/services/translate_status_service.rb
Commit date: 2023-09-19 16:53:21 +0200
Commit message: Merge pull request from GHSA-2693-xr3m-jhqr


Diff: diff --git a/app/services/translate_status_service.rb b/app/services/translate_status_service.rb
index c2b40433ed6..9ad146ae7d3 100644
--- a/app/services/translate_status_service.rb
+++ b/app/services/translate_status_service.rb
@@ -73,11 +73,13 @@ class TranslateStatusService < BaseService
     @source_texts.keys.each_with_index do |source, index|
       translation = translations[index]
 
       case source
       when :content
-        status_translation.content = unwrap_emoji_shortcodes(translation.text).to_html
+        node = unwrap_emoji_shortcodes(translation.text)
+        Sanitize.node!(node, Sanitize::Config::MASTODON_STRICT)
+        status_translation.content = node.to_html
       when :spoiler_text
         status_translation.spoiler_text = unwrap_emoji_shortcodes(translation.text).content
       when Poll::Option
         status_translation.poll_options << Translation::Option.new(
           title: unwrap_emoji_shortcodes(translation.text).content

Vulnerable code:         status_translation.content = unwrap_emoji_shortcodes(translation.text).to_html
Fixed code:         node = unwrap_emoji_shortcodes(translation.text)
        Sanitize.node!(node, Sanitize::Config::MASTODON_STRICT)
        status_translation.content = node.to_html
CVE-2019-17533: Out-of-bounds Read (CWE-125)
value: Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.2
Published: 2019-10-13T02:15Z
Repository: https://github.com/tbeu/matio
Language: C
Files changed: src/mat4.c
Commit date: 2019-08-30 09:21:26 +0200
Commit message: Avoid uninitialized memory

As reported by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16856

Diff: diff --git a/src/mat4.c b/src/mat4.c
index 601a3d6..93b4308 100644
--- a/src/mat4.c
+++ b/src/mat4.c
@@ -915,10 +915,12 @@ Mat_VarReadNextInfo4(mat_t *mat)
     }
     readresult = fread(matvar->name,1,tmp,(FILE*)mat->fp);
     if ( tmp != readresult ) {
         Mat_VarFree(matvar);
         return NULL;
+    } else {
+        matvar->name[tmp - 1] = '\0';
     }
 
     matvar->internal->datapos = ftell((FILE*)mat->fp);
     if ( matvar->internal->datapos == -1L ) {
         Mat_VarFree(matvar);

Fixed code:     } else {
        matvar->name[tmp - 1] = '\0';
CVE-2019-17533: Use of Uninitialized Resource (CWE-908)
value: Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 8.2
Published: 2019-10-13T02:15Z
Repository: https://github.com/tbeu/matio
Language: C
Files changed: src/mat4.c
Commit date: 2019-08-30 09:21:26 +0200
Commit message: Avoid uninitialized memory

As reported by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16856

Diff: diff --git a/src/mat4.c b/src/mat4.c
index 601a3d6..93b4308 100644
--- a/src/mat4.c
+++ b/src/mat4.c
@@ -915,10 +915,12 @@ Mat_VarReadNextInfo4(mat_t *mat)
     }
     readresult = fread(matvar->name,1,tmp,(FILE*)mat->fp);
     if ( tmp != readresult ) {
         Mat_VarFree(matvar);
         return NULL;
+    } else {
+        matvar->name[tmp - 1] = '\0';
     }
 
     matvar->internal->datapos = ftell((FILE*)mat->fp);
     if ( matvar->internal->datapos == -1L ) {
         Mat_VarFree(matvar);

Fixed code:     } else {
        matvar->name[tmp - 1] = '\0';
CVE-2022-0482: Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)
value: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
CWE description: The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CVSS v3 base score: 9.1
Published: 2022-03-09T11:15Z
Repository: https://github.com/alextselegidis/easyappointments
Language: PHP
Files changed: application/config/config.php
Commit date: 2022-03-08 18:27:15 +0100
Commit message: Release v1.4.3

Diff: diff --git a/application/config/config.php b/application/config/config.php
index 4c06eb6a..6efb9d80 100644
--- a/application/config/config.php
+++ b/application/config/config.php
@@ -6,11 +6,11 @@
 |--------------------------------------------------------------------------
 |
 | Declare some of the global config values of Easy!Appointments.
 |
 */
-$config['version'] = '1.4.3-beta.1'; // This must be changed manually.
+$config['version'] = '1.4.3'; // This must be changed manually.
 $config['release_label'] = ''; // Leave empty for no title or add Alpha, Beta etc ...
 $config['debug'] = Config::DEBUG_MODE;
 
 /*
 |--------------------------------------------------------------------------
@@ -312,11 +312,11 @@ $config['cache_path'] = __DIR__ . '/../../storage/cache/';
 | This token will be appending to asset URLs in order to invalidate the browser
 | cache and enforce end clients to fetch new files. Update the token with each
 | new release.
 |
 */
-$config['cache_busting_token'] = '8UC842';
+$config['cache_busting_token'] = '6398SW';
 
 /*
 |--------------------------------------------------------------------------
 | Encryption Key
 |--------------------------------------------------------------------------

Vulnerable code: $config['version'] = '1.4.3-beta.1'; // This must be changed manually.
$config['cache_busting_token'] = '8UC842';
Fixed code: $config['version'] = '1.4.3'; // This must be changed manually.
$config['cache_busting_token'] = '6398SW';
CVE-2022-1397: Improper Privilege Management (CWE-269)
value: API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 8.8
Published: 2022-05-10T14:15Z
Repository: https://github.com/alextselegidis/easyappointments
Language: PHP
Files changed: application/libraries/Api.php
Commit date: 2022-05-09 23:26:28 +0200
Commit message: Check the role slug in Api.php

Diff: diff --git a/application/libraries/Api.php b/application/libraries/Api.php
index bc60d542..863e881d 100644
--- a/application/libraries/Api.php
+++ b/application/libraries/Api.php
@@ -75,11 +75,13 @@ class Api {
             // Basic auth.  
             $username = $_SERVER['PHP_AUTH_USER'];
 
             $password = $_SERVER['PHP_AUTH_PW'];
 
-            if ( ! $this->CI->accounts->check_login($username, $password))
+            $userdata = $this->CI->accounts->check_login($username, $password);
+
+            if (empty($userdata['role_slug']) || $userdata['role_slug'] !== DB_SLUG_ADMIN)
             {
                 throw new RuntimeException('The provided credentials do not match any admin user!', 401, 'Unauthorized');
             }
         }
         catch (Throwable $e)

Vulnerable code:             if ( ! $this->CI->accounts->check_login($username, $password))
Fixed code:             $userdata = $this->CI->accounts->check_login($username, $password);

            if (empty($userdata['role_slug']) || $userdata['role_slug'] !== DB_SLUG_ADMIN)
CVE-2023-2102: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-04-15T13:15Z
Repository: https://github.com/alextselegidis/easyappointments
Language: PHP
Files changed: application/views/components/backend_header.php
Commit date: 2023-04-15 14:03:51 +0200
Commit message: Escape the user display name in the backend section

Diff: diff --git a/application/views/components/backend_header.php b/application/views/components/backend_header.php
index f631d5d6a..a67911b6c 100755
--- a/application/views/components/backend_header.php
+++ b/application/views/components/backend_header.php
@@ -84,11 +84,11 @@
             <?php $active = $active_menu == PRIV_SYSTEM_SETTINGS ? 'active' : '' ?>
             <li class="nav-item dropdown <?= $active . $hidden ?>">
                 <a class="nav-link dropdown-toggle" href="#" data-bs-toggle="dropdown"
                    data-tippy-content="<?= lang('settings_hint') ?>">
                     <i class="fas fa-user me-2"></i>
-                    <?= vars('user_display_name') ?>
+                    <?= e(vars('user_display_name')) ?>
                 </a>
                 <div class="dropdown-menu dropdown-menu-end">
                     <?php if (can('view', PRIV_SYSTEM_SETTINGS)): ?>
                         <a class="dropdown-item" href="<?= site_url('general_settings') ?>">
                             <?= lang('settings') ?>

Vulnerable code:                     <?= vars('user_display_name') ?>
Fixed code:                     <?= e(vars('user_display_name')) ?>
CVE-2023-2105: Session Fixation (CWE-384)
value: Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 8.8
Published: 2023-04-15T14:15Z
Repository: https://github.com/alextselegidis/easyappointments
Language: PHP
Files changed: application/controllers/Login.php
Commit date: 2023-04-15 14:46:30 +0200
Commit message: Regenerate the session ID after logging in to avoid Session Fixation attacks

Diff: diff --git a/application/controllers/Login.php b/application/controllers/Login.php
index 8cb50972c..bb627b750 100644
--- a/application/controllers/Login.php
+++ b/application/controllers/Login.php
@@ -74,10 +74,12 @@ class Login extends EA_Controller {
 
             if (empty($user_data))
             {
                 throw new InvalidArgumentException('Invalid credentials provided, please try again.');
             }
+            
+            $this->session->sess_regenerate();
 
             session($user_data); // Save data in the session.
 
             json_response([
                 'success' => TRUE,

Fixed code:             
            $this->session->sess_regenerate();
CVE-2019-11454: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-04-22T16:29Z
Repository: https://bitbucket.org/tildeslash/monit
Language: Other
Files changed: CHANGES, src/http/cervlet.c
Commit date: 2019-03-04 14:13:42 +0100
Commit message: Fixed: HTML escape the log file content when viewed via Monit GUI.

Diff: diff --git a/CHANGES b/CHANGES
index 91a087da..a29897b7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -25,10 +25,12 @@ Fixed: Issue #784: Radius protocol test regression from 5.25.2. Thanks to Jason
 Fixed: Issue #790: check process: The exec action's environment contains invalid value for
 MONIT_PROCESS_* variables.
 
 Fixed: The CPU user/system/wait statistics may show negative value if the system counter jumps back or wraps.
 
+Fixed: HTML escape the log file content when viewed via Monit GUI.
+
 
 Version 5.25.2
 
 New: Issue #123: Added a bash completion script for monit command-line. The script is not installed
 by default, if you want to enable the bash completion for monit, copy system/bash/monit file to
diff --git a/src/http/cervlet.c b/src/http/cervlet.c
index 9e3cd9c9..afba84bf 100644
--- a/src/http/cervlet.c
+++ b/src/http/cervlet.c
@@ -905,11 +905,11 @@ static void do_viewlog(HttpRequest req, HttpResponse res) {
                         size_t n;
                         char buf[512];
                         StringBuffer_append(res->outputbuffer, "<br><p><form><textarea cols=120 rows=30 readonly>");
                         while ((n = fread(buf, sizeof(char), sizeof(buf) - 1, f)) > 0) {
                                 buf[n] = 0;
-                                StringBuffer_append(res->outputbuffer, "%s", buf);
+                                escapeHTML(res->outputbuffer, buf);
                         }
                         fclose(f);
                         StringBuffer_append(res->outputbuffer, "</textarea></form>");
                 } else {
                         StringBuffer_append(res->outputbuffer, "Error opening logfile: %s", STRERROR);

Vulnerable code:                                 StringBuffer_append(res->outputbuffer, "%s", buf);
Fixed code: Fixed: HTML escape the log file content when viewed via Monit GUI.

                                escapeHTML(res->outputbuffer, buf);
CVE-2019-11454: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-04-22T16:29Z
Repository: https://bitbucket.org/tildeslash/monit
Language: Other
Files changed: CHANGES
Commit date: 2019-03-04 15:08:37 +0100
Commit message: text + add the reporter name for viewlog XSS vulnerability report

Diff: diff --git a/CHANGES b/CHANGES
index a29897b7..8479413b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -25,11 +25,12 @@ Fixed: Issue #784: Radius protocol test regression from 5.25.2. Thanks to Jason
 Fixed: Issue #790: check process: The exec action's environment contains invalid value for
 MONIT_PROCESS_* variables.
 
 Fixed: The CPU user/system/wait statistics may show negative value if the system counter jumps back or wraps.
 
-Fixed: HTML escape the log file content when viewed via Monit GUI.
+Fixed: XSS vulnerabilitty: HTML escape the log file content when viewed via Monit GUI. Thanks for Zack Flack
+for report.
 
 
 Version 5.25.2
 
 New: Issue #123: Added a bash completion script for monit command-line. The script is not installed

Vulnerable code: Fixed: HTML escape the log file content when viewed via Monit GUI.
Fixed code: Fixed: XSS vulnerabilitty: HTML escape the log file content when viewed via Monit GUI. Thanks for Zack Flack
for report.