Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-21293: Allocation of Resources Without Limits or Throttling (CWE-770)
value: blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections. The vast majority of affected users are using it as part of http4s-blaze-server <= 0.21.16. http4s provides a mechanism for limiting open connections, but is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open. The issue is fixed in version 0.14.15 for "NIO1SocketServerGroup". A "maxConnections" parameter is added, with a default value of 512. Concurrent connections beyond this limit are rejected. To run unbounded, which is not recommended, set a negative number. The "NIO2SocketServerGroup" has no such setting and is now deprecated. There are several possible workarounds described in the refrenced GitHub Advisory GHSA-xmw9-q7x9-j5qc.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2021-02-02T22:15Z
Repository: https://github.com/http4s/blaze
Language: Unknown
Commit date: 2021-02-02 10:48:42 -0500
Commit message: Merge pull request from GHSA-xmw9-q7x9-j5qc

Fix GHSA-xmw9-q7x9-j5qc by limiting accepted connections
CVE-2022-4892: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in MyCMS. It has been classified as problematic. This affects the function build_view of the file lib/gener/view.php of the component Visitors Module. The manipulation of the argument original/converted leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named d64fcba4882a50e21cdbec3eb4a080cb694d26ee. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218895.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-19T08:15Z
Repository: https://github.com/andrzuk/MyCMS
Language: PHP
Files changed: lib/gener/view.php
Commit date: 2022-06-01 09:32:13 +0200
Commit message: Vulnerability fix: add strip_tags to details view in visitors module.

Diff: diff --git a/lib/gener/view.php b/lib/gener/view.php
index ac6de7f..690703c 100644
--- a/lib/gener/view.php
+++ b/lib/gener/view.php
@@ -151,11 +151,11 @@ class ViewBuilder
 						{
 							if ($ik == 'original') $original = $iv;
 							if ($ik == 'converted') $converted = $iv;
 						}
 						$main_text .= '<div>';
-						$main_text .= '<a href="' . $original . '" target="_blank">' . $converted . '</a>';
+						$main_text .= '<a href="' . strip_tags($original) . '" target="_blank">' . strip_tags($converted) . '</a>';
 						$main_text .= '</div>';
 					}
 					else // zwykłe dane
 					{
 						foreach ($this->row[$db_name] as $ik => $iv)
@@ -167,11 +167,11 @@ class ViewBuilder
 					}
 				}
 			}
 			else if (substr($this->row[$db_name], 0, 4) == '<img') // obrazek
 			{
-				$main_text .= $this->row[$db_name];
+				$main_text .= strip_tags($this->row[$db_name]);
 			}
 			else // zwykłe dane
 			{
 				$main_text .= $this->get_split_text(strip_tags($this->row[$db_name]), 100);
 			}

Vulnerable code: 						$main_text .= '<a href="' . $original . '" target="_blank">' . $converted . '</a>';
				$main_text .= $this->row[$db_name];
Fixed code: 						$main_text .= '<a href="' . strip_tags($original) . '" target="_blank">' . strip_tags($converted) . '</a>';
				$main_text .= strip_tags($this->row[$db_name]);
CVE-2023-28115: Deserialization of Untrusted Data (CWE-502)
value: Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If a user can control the output file from the `generateFromHtml()` function, it will invoke deserialization. This vulnerability is capable of remote code execution if Snappy is used with frameworks or developer code with vulnerable POP chains. It has been fixed in version 1.4.2.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2023-03-17T22:15Z
Repository: https://github.com/KnpLabs/snappy
Language: Unknown
Commit date: 2023-03-17 15:47:54 +0100
Commit message: Merge pull request #469 from KnpLabs/fix/GHSA-gq6w-q6wh-jggc

fix: security issue GHSA-gq6w-q6wh-jggc
CVE-2023-41330: Deserialization of Untrusted Data (CWE-502)
value: knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page.
## Issue

On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. Version 1.4.2 added a check `if (\strpos($filename, 'phar://') === 0)` in the `prepareOutput` function to resolve this CVE, however if the user is able to control the second parameter of the `generateFromHtml()` function of Snappy, it will then be passed as the `$filename` parameter in the `prepareOutput()` function. In the original vulnerability, a file name with a `phar://` wrapper could be sent to the `fileExists()` function, equivalent to the `file_exists()` PHP function. This allowed users to trigger a deserialization on arbitrary PHAR files. To fix this issue, the string is now passed to the `strpos()` function and if it starts with `phar://`, an exception is raised. However, PHP wrappers being case insensitive, this patch can be bypassed using `PHAR://` instead of `phar://`. A successful exploitation of this vulnerability allows executing arbitrary code and accessing the underlying filesystem. The attacker must be able to upload a file and the server must be running a PHP version prior to 8. This issue has been addressed in commit `d3b742d61a` which has been included in version 1.4.3. Users are advised to upgrade. Users unable to upgrade should ensure that only trusted users may submit data to the `AbstractGenerator->generate(...)` function.

CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2023-09-06T18:15Z
Repository: https://github.com/KnpLabs/snappy
Language: Unknown
Commit date: 2023-09-06 17:24:48 +0200
Commit message: Merge pull request #488 from KnpLabs/fix/security-advisory-GHSA-92rv-4j2h-8mjj

fix: security advisory GHSA-92rv-4j2h-8mjj
CVE-2018-19045: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially leaking sensitive information.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2018-11-08T20:29Z
Repository: https://github.com/acassen/keepalived
Language: C
Files changed: keepalived/core/main.c
Commit date: 2018-10-31 21:57:02 +0000
Commit message: Fix compile warning introduced in commit c6247a9

Commit c6247a9 - "Add command line and configuration option to set umask"
introduced a compile warning, although the code would have worked OK.

Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>

Diff: diff --git a/keepalived/core/main.c b/keepalived/core/main.c
index 6670ada2..03757f6f 100644
--- a/keepalived/core/main.c
+++ b/keepalived/core/main.c
@@ -880,11 +880,11 @@ set_umask(const char *optarg)
 
 	umask_long = strtoll(optarg, &endptr, 0);
 
 	if (*endptr || umask_long < 0 || umask_long & ~0777L) {
 		fprintf(stderr, "Invalid --umask option %s", optarg);
-		return;
+		return 0;
 	}
 
 	umask_val = umask_long & 0777;
 	umask(umask_val);
 

Vulnerable code: 		return;
Fixed code: 		return 0;
CVE-2021-44225: Other (NVD-CWE-Other)
value: In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.4
Published: 2021-11-26T00:15Z
Repository: https://github.com/acassen/keepalived
Language: Other
Files changed: keepalived/dbus/org.keepalived.Vrrp1.conf
Commit date: 2021-11-23 06:50:59 +0100
Commit message: dbus: fix policy to not be overly broad

The DBus policy did not restrict the message destination, allowing any
user to inspect and manipulate any property.

Signed-off-by: Vincent Bernat <vincent@bernat.ch>

Diff: diff --git a/keepalived/dbus/org.keepalived.Vrrp1.conf b/keepalived/dbus/org.keepalived.Vrrp1.conf
index 2b78a575c..b5ced6085 100644
--- a/keepalived/dbus/org.keepalived.Vrrp1.conf
+++ b/keepalived/dbus/org.keepalived.Vrrp1.conf
@@ -1,14 +1,17 @@
 <!DOCTYPE busconfig PUBLIC
 "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
 	<policy user="root">
-		<allow own="org.keepalived.Vrrp1"/>
-		<allow send_destination="org.keepalived.Vrrp1"/>
+		<allow own="org.keepalived.Vrrp1" />
+		<allow send_destination="org.keepalived.Vrrp1" />
 	</policy>
 	<policy context="default">
-		<allow send_interface="org.freedesktop.DBus.Introspectable" />
-		<allow send_interface="org.freedesktop.DBus.Peer" />
-		<allow send_interface="org.freedesktop.DBus.Properties" />
+		<allow send_destination="org.keepalived.Vrrp1"
+		       send_interface="org.freedesktop.DBus.Introspectable" />
+		<allow send_destination="org.keepalived.Vrrp1"
+		       send_interface="org.freedesktop.DBus.Peer" />
+		<allow send_destination="org.keepalived.Vrrp1"
+		       send_interface="org.freedesktop.DBus.Properties" />
 	</policy>
 </busconfig>

Vulnerable code: 		<allow own="org.keepalived.Vrrp1"/>
		<allow send_destination="org.keepalived.Vrrp1"/>
		<allow send_interface="org.freedesktop.DBus.Introspectable" />
		<allow send_interface="org.freedesktop.DBus.Peer" />
		<allow send_interface="org.freedesktop.DBus.Properties" />
Fixed code: 		<allow own="org.keepalived.Vrrp1" />
		<allow send_destination="org.keepalived.Vrrp1" />
		<allow send_destination="org.keepalived.Vrrp1"
		       send_interface="org.freedesktop.DBus.Introspectable" />
		<allow send_destination="org.keepalived.Vrrp1"
		       send_interface="org.freedesktop.DBus.Peer" />
		<allow send_destination="org.keepalived.Vrrp1"
		       send_interface="org.freedesktop.DBus.Properties" />
CVE-2017-20158: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 is able to address this issue. The identifier of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-31T11:15Z
Repository: https://github.com/vova07/yii2-fileapi-widget
Language: Other
Files changed: .gitignore, actions/UploadAction.php
Commit date: 2017-03-24 11:49:00 +0200
Commit message: Fix XSS vulnerability

Diff: diff --git a/.gitignore b/.gitignore
index 723ef36..de4a392 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
-.idea
\ No newline at end of file
+/vendor
+/composer.lock
diff --git a/actions/UploadAction.php b/actions/UploadAction.php
index 6dca065..05cf40a 100644
--- a/actions/UploadAction.php
+++ b/actions/UploadAction.php
@@ -6,10 +6,11 @@ use vova07\fileapi\Widget;
 use yii\base\Action;
 use yii\base\DynamicModel;
 use yii\base\InvalidCallException;
 use yii\base\InvalidConfigException;
 use yii\helpers\FileHelper;
+use yii\helpers\Html;
 use yii\web\BadRequestHttpException;
 use yii\web\Response;
 use yii\web\UploadedFile;
 use Yii;
 
@@ -91,11 +92,11 @@ class UploadAction extends Action
             $model = new DynamicModel(compact('file'));
             $model->addRule('file', $this->_validator, $this->validatorOptions)->validate();
 
             if ($model->hasErrors()) {
                 $result = [
-                    'error' => $model->getFirstError('file')
+                    'error' => Html::encode($model->getFirstError('file')),
                 ];
             } else {
                 if ($this->unique === true && $model->file->extension) {
                     $model->file->name = uniqid() . '.' . $model->file->extension;
                 }

Vulnerable code: .idea
                    'error' => $model->getFirstError('file')
Fixed code: /vendor
/composer.lock
use yii\helpers\Html;
                    'error' => Html::encode($model->getFirstError('file')),
CVE-2023-0860: Improper Restriction of Excessive Authentication Attempts (CWE-307)
value: Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
CWE description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVSS v3 base score: 7.5
Published: 2023-02-16T10:15Z
Repository: https://github.com/modoboa/modoboa-installer
Language: Unknown
Commit date: 2023-01-31 09:09:51 +0100
Commit message: Merge pull request #474 from modoboa/security/fail2ban

Added fail2ban setup
CVE-2019-9547: Excessive Iteration (CWE-834)
value: In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could carefully construct a circular descriptor chain that would result in a partial denial of service in the SPDK vhost target, because the vhost target did not properly detect such chains.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 5.3
Published: 2019-03-01T22:29Z
Repository: https://github.com/spdk/spdk
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2019-02-01 08:42:28 +0000
Commit message: CHANGELOG: add note on vhost vulnerability

Signed-off-by: Jim Harris <james.r.harris@intel.com>
Change-Id: Id47256ecfc5d774e7d8054423cda32a90f0c4f76

Reviewed-on: https://review.gerrithub.io/c/442929
Chandler-Test-Pool: SPDK Automated Test System <sys_sgsw@intel.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Darek Stojaczyk <dariusz.stojaczyk@intel.com>
Reviewed-by: Tomasz Zawadzki <tomasz.zawadzki@intel.com>

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 79de470ba..1c8d8c6e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -189,10 +189,17 @@ EXPERIMENTAL: Added basic flash translation layer module allowing for using Open
 block devices. The module is split into the library (located in lib/ftl) and bdev_ftl
 (lib/bdev/ftl). See the [documentation](https://spdk.io/doc/ftl.html) for more details.
 
 ### vhost
 
+A security vulnerability has been identified and fixed in the SPDK vhost target.  A malicious
+vhost client (i.e. virtual machine) could carefully construct a circular descriptor chain which
+would result in a partial denial of service in the SPDK vhost target.  These types of descriptor
+chains are now properly detected by the vhost target.  All SPDK vhost users serving untrusted
+vhost clients are strongly recommended to upgrade. (Reported by Dima Stepanov and Evgeny
+Yakovlev.)
+
 Vhost SCSI and Vhost Block devices can now accept multiple connections on the same socket file.
 Each connection (internally called a vhost session) will have access to the same storage, but
 will use different virtqueues, different features and possibly different memory.
 
 ### vhost scsi

Fixed code: A security vulnerability has been identified and fixed in the SPDK vhost target.  A malicious
vhost client (i.e. virtual machine) could carefully construct a circular descriptor chain which
would result in a partial denial of service in the SPDK vhost target.  These types of descriptor
chains are now properly detected by the vhost target.  All SPDK vhost users serving untrusted
vhost clients are strongly recommended to upgrade. (Reported by Dima Stepanov and Evgeny
Yakovlev.)
CVE-2022-23492: Allocation of Resources Without Limits or Throttling (CWE-770)
value: go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of go-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to upgrade their version of go-libp2p to version `0.18.1` or newer. Users unable to upgrade may consult the denial of service (dos) mitigation page for more information on how to incorporate mitigation strategies, monitor your application, and respond to attacks.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2022-12-08T01:15Z
Repository: https://github.com/libp2p/go-libp2p
Language: Unknown
Commit date: 2022-01-18 01:25:41 -0800
Commit message: Merge pull request #1275 from libp2p/rcmgr

use the resource manager
CVE-2018-1000207: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 7.2
Published: 2018-07-13T18:29Z
Repository: https://github.com/modxcms/revolution
Language: Other
Files changed: core/docs/changelog.txt
Commit date: 2018-07-09 14:46:55 +0300
Commit message: Filtering user parameters before passing them into phpthumb class #13979

* upstream/pr/13979:
  Added strict mode for in_array
  Returns the missed in the past the considering to phpthumb_imagemagick_path system setting
  Limit parameters incoming from users to only allowed from phpthumb
  Some code cleanup before fix

Diff: diff --cc core/docs/changelog.txt
index 4951dd3281,4951dd3281..87fd2a061b
--- a/core/docs/changelog.txt
+++ b/core/docs/changelog.txt
@@@ -2,10 -2,10 +2,11 @@@
  This file shows the changes in recent releases of MODX. The most current release is usually the
  development release, and is only shown to give an idea of what's currently in the pipeline.
  
  MODX Revolution 2.7.0-pl (TBD)
  ====================================
++- Filtering user parameters before passing them into phpthumb class #13979
  - Update phpThumb to 1.7.15-201806071234 #13938
  - Require minimal PHP version (in composer.json) #13939
  - Prefer ampersand replacement of the the translit class [#13931]
  - Add iconv_ascii transliteration [#13932]
  - Add set_sudo permission [#13807]

Fixed code: +- Filtering user parameters before passing them into phpthumb class #13979
CVE-2015-4619: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2017-09-07T20:29Z
Repository: https://github.com/denkGroot/Spina
Language: Ruby
Files changed: app/controllers/spina/application_controller.rb
Commit date: 2015-06-16 16:23:27 +0200
Commit message: protect from forgery

Diff: diff --git a/app/controllers/spina/application_controller.rb b/app/controllers/spina/application_controller.rb
index 257f5fb..bf39207 100644
--- a/app/controllers/spina/application_controller.rb
+++ b/app/controllers/spina/application_controller.rb
@@ -1,7 +1,9 @@
 module Spina
   class ApplicationController < ActionController::Base
+    protect_from_forgery
+    
     include ApplicationHelper
 
     private
 
     def current_ability

Fixed code:     protect_from_forgery
CVE-2020-15120: Incorrect Authorization (CWE-863)
value: In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. This is fixed in version 4.1.5.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.9
Published: 2020-07-27T18:15Z
Repository: https://github.com/spiral-project/ihatemoney
Language: Python
Files changed: ihatemoney/models.py
Commit date: 2020-07-26 19:21:16 +0200
Commit message: Fix unauthorized access and modification of project data (CVE-2020-15120)

An authenticated member of one project can modify and delete members of
another project, without knowledge of this other project's private
code. This can be further exploited to access all bills of another project
without knowledge of this other project's private code.

With the default configuration, anybody is allowed to create a new
project. An attacker can create a new project and then use it to become
authenticated and exploit this flaw. As such, the exposure is similar to
an unauthenticated attack, because it is trivial to become authenticated.

This issue was caused by a wrong database queries in PersonQuery.

For more details, see https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9

Diff: diff --git a/ihatemoney/models.py b/ihatemoney/models.py
index fe7b519..5691c75 100644
--- a/ihatemoney/models.py
+++ b/ihatemoney/models.py
@@ -378,20 +378,20 @@ class Project(db.Model):
 class Person(db.Model):
     class PersonQuery(BaseQuery):
         def get_by_name(self, name, project):
             return (
                 Person.query.filter(Person.name == name)
-                .filter(Project.id == project.id)
+                .filter(Person.project_id == project.id)
                 .one()
             )
 
         def get(self, id, project=None):
             if not project:
                 project = g.project
             return (
                 Person.query.filter(Person.id == id)
-                .filter(Project.id == project.id)
+                .filter(Person.project_id == project.id)
                 .one()
             )
 
     query_class = PersonQuery
 

Vulnerable code:                 .filter(Project.id == project.id)
                .filter(Project.id == project.id)
Fixed code:                 .filter(Person.project_id == project.id)
                .filter(Person.project_id == project.id)
CVE-2014-0791: Numeric Errors (CWE-189)
value: Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2014-01-03T18:54Z
Repository: https://github.com/sidhpurwala-huzaifa/FreeRDP
Language: C
Files changed: libfreerdp/core/license.c
Commit date: 2014-01-02 14:34:03 +0530
Commit message: Fix possible integer overflow in license_read_scope_list()

Diff: diff --git a/libfreerdp/core/license.c b/libfreerdp/core/license.c
index e26e5e0f..d5b5d33a 100644
--- a/libfreerdp/core/license.c
+++ b/libfreerdp/core/license.c
@@ -668,10 +668,13 @@ BOOL license_read_scope_list(wStream* s, SCOPE_LIST* scopeList)
 	if (Stream_GetRemainingLength(s) < 4)
 		return FALSE;
 
 	Stream_Read_UINT32(s, scopeCount); /* ScopeCount (4 bytes) */
 
+        if (Stream_GetRemainingLength(s) / sizeof(LICENSE_BLOB) < scopeCount)
+                return FALSE;  /* Avoid overflow in malloc */
+
 	scopeList->count = scopeCount;
 	scopeList->array = (LICENSE_BLOB*) malloc(sizeof(LICENSE_BLOB) * scopeCount);
 
 	/* ScopeArray */
 	for (i = 0; i < scopeCount; i++)

Fixed code:         if (Stream_GetRemainingLength(s) / sizeof(LICENSE_BLOB) < scopeCount)
                return FALSE;  /* Avoid overflow in malloc */
CVE-2022-4065: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.8
Published: 2022-11-19T19:15Z
Repository: https://github.com/cbeust/testng
Language: Unknown
Commit date: 2022-10-04 19:14:28 +0200
Commit message: Merge pull request #2806 from BulkSecurityGeneratorProjectV2/fix/JLL/zip-slip-vulnerability

[SECURITY] Fix Zip Slip Vulnerability
CVE-2021-27097: Insufficient Information (NVD-CWE-noinfo)
value: The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2021-02-17T23:15Z
Repository: https://github.com/u-boot/u-boot
Language: Unknown
Commit date: 2021-02-15 22:31:54 -0500
Commit message: Merge branch '2021-02-15-fix-CVE-2021-27097-CVE-2021-27138'

Fix CVE-2021-27097 and CVE-2021-27138.  For more details see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27097 and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27138
CVE-2021-27097: Insufficient Information (NVD-CWE-noinfo)
value: The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2021-02-17T23:15Z
Repository: https://github.com/u-boot/u-boot
Language: C
Files changed: common/fdt_region.c
Commit date: 2021-02-15 19:17:18 -0500
Commit message: fdt_region: Check for a single root node of the correct name

At present fdt_find_regions() assumes that the FIT is a valid devicetree.
If the FIT has two root nodes this is currently not detected in this
function, nor does libfdt's fdt_check_full() notice. Also it is possible
for the root node to have a name even though it should not.

Add checks for these and return -FDT_ERR_BADSTRUCTURE if a problem is
detected.

CVE-2021-27097

Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>

Diff: diff --git a/common/fdt_region.c b/common/fdt_region.c
index ff12c518e97..e4ef0ca7703 100644
--- a/common/fdt_region.c
+++ b/common/fdt_region.c
@@ -41,10 +41,11 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
 	int count = 0;
 	int start = -1;
 	int depth = -1;
 	int want = 0;
 	int base = fdt_off_dt_struct(fdt);
+	bool expect_end = false;
 
 	end = path;
 	*end = '\0';
 	do {
 		const struct fdt_property *prop;
@@ -57,10 +58,14 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
 
 		offset = nextoffset;
 		tag = fdt_next_tag(fdt, offset, &nextoffset);
 		stop_at = nextoffset;
 
+		/* If we see two root nodes, something is wrong */
+		if (expect_end && tag != FDT_END)
+			return -FDT_ERR_BADLAYOUT;
+
 		switch (tag) {
 		case FDT_PROP:
 			include = want >= 2;
 			stop_at = offset;
 			prop = fdt_get_property_by_offset(fdt, offset, NULL);
@@ -79,10 +84,14 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
 		case FDT_BEGIN_NODE:
 			depth++;
 			if (depth == FDT_MAX_DEPTH)
 				return -FDT_ERR_BADSTRUCTURE;
 			name = fdt_get_name(fdt, offset, &len);
+
+			/* The root node must have an empty name */
+			if (!depth && *name)
+				return -FDT_ERR_BADLAYOUT;
 			if (end - path + 2 + len >= path_len)
 				return -FDT_ERR_NOSPACE;
 			if (end != path + 1)
 				*end++ = '/';
 			strcpy(end, name);
@@ -106,10 +115,12 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
 			include = want;
 			want = stack[depth--];
 			while (end > path && *--end != '/')
 				;
 			*end = '\0';
+			if (depth == -1)
+				expect_end = true;
 			break;
 
 		case FDT_END:
 			include = 1;
 			break;

Fixed code: 	bool expect_end = false;
		/* If we see two root nodes, something is wrong */
		if (expect_end && tag != FDT_END)
			return -FDT_ERR_BADLAYOUT;


			/* The root node must have an empty name */
			if (!depth && *name)
				return -FDT_ERR_BADLAYOUT;
			if (depth == -1)
				expect_end = true;
CVE-2021-27138: Insufficient Information (NVD-CWE-noinfo)
value: The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2021-02-17T23:15Z
Repository: https://github.com/u-boot/u-boot
Language: Unknown
Commit date: 2021-02-15 22:31:54 -0500
Commit message: Merge branch '2021-02-15-fix-CVE-2021-27097-CVE-2021-27138'

Fix CVE-2021-27097 and CVE-2021-27138.  For more details see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27097 and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27138
CVE-2022-30767: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2022-05-16T03:15Z
Repository: https://github.com/u-boot/u-boot
Language: C
Files changed: net/nfs.c
Commit date: 2019-09-04 11:37:19 -0500
Commit message: CVE-2019-14196: nfs: fix unbounded memcpy with a failed length check at nfs_lookup_reply

This patch adds a check to rpc_pkt.u.reply.data at nfs_lookup_reply.

Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>

Diff: diff --git a/net/nfs.c b/net/nfs.c
index 915acd95cf8..89952aeb662 100644
--- a/net/nfs.c
+++ b/net/nfs.c
@@ -564,15 +564,19 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len)
 		}
 		return -1;
 	}
 
 	if (supported_nfs_versions & NFSV2_FLAG) {
+		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + NFS_FHSIZE) > len)
+			return -NFS_RPC_DROP;
 		memcpy(filefh, rpc_pkt.u.reply.data + 1, NFS_FHSIZE);
 	} else {  /* NFSV3_FLAG */
 		filefh3_length = ntohl(rpc_pkt.u.reply.data[1]);
 		if (filefh3_length > NFS3_FHSIZE)
 			filefh3_length  = NFS3_FHSIZE;
+		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + filefh3_length) > len)
+			return -NFS_RPC_DROP;
 		memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length);
 	}
 
 	return 0;
 }

Fixed code: 		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + NFS_FHSIZE) > len)
			return -NFS_RPC_DROP;
		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + filefh3_length) > len)
			return -NFS_RPC_DROP;
CVE-2023-50917: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-12-15T17:15Z
Repository: https://github.com/sergejey/majordomo
Language: PHP
Files changed: modules/thumb/thumb.php
Commit date: 2023-11-15 18:23:46 +0200
Commit message: Update thumb.php

Diff: diff --git a/modules/thumb/thumb.php b/modules/thumb/thumb.php
index 32f4704b..c0490483 100644
--- a/modules/thumb/thumb.php
+++ b/modules/thumb/thumb.php
@@ -78,14 +78,14 @@ if (isset($url) && $url != '') {
 
     if (preg_match('/^rtsp:/is', $url) || preg_match('/\/dev/', $url)) {
         //-rtsp_transport tcp // -rtsp_transport tcp
         $stream_options = '-timelimit 15 -y -i ' . escapeshellarg($url) . ($resize) . ' -r 5 -f image2 -vframes 1'; //-ss 00:00:01.500
         if ($debug_mode) {
-            $stream_options = '-v verbose ' . escapeshellarg($stream_options);
+            $stream_options = '-v verbose ' . $stream_options;
         }
         if ($transport) {
-            $stream_options = '-rtsp_transport ' . escapeshellarg($transport) . ' ' . escapeshellarg($stream_options);
+            $stream_options = '-rtsp_transport ' . escapeshellarg($transport) . ' ' . $stream_options;
         }
         $cmd = PATH_TO_FFMPEG . ' ' . $stream_options . ' ' . escapeshellarg($img);
 
         if ($live) {
             $boundary = "my_mjpeg";

Vulnerable code:             $stream_options = '-v verbose ' . escapeshellarg($stream_options);
            $stream_options = '-rtsp_transport ' . escapeshellarg($transport) . ' ' . escapeshellarg($stream_options);
Fixed code:             $stream_options = '-v verbose ' . $stream_options;
            $stream_options = '-rtsp_transport ' . escapeshellarg($transport) . ' ' . $stream_options;
CVE-2019-25090: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the component Views Handler. The manipulation of the argument dataurl leads to cross site scripting. The attack may be launched remotely. Upgrading to version 13.0.5.4 is able to address this issue. The name of the patch is 199dea7cc7020d3c469a86a39fbd80f5edd3c5ab. It is recommended to upgrade the affected component. VDB-216878 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T13:15Z
Repository: https://github.com/FreePBX/arimanager
Language: Unknown
Commit date: 2019-11-25 11:44:57 +0000
Commit message: Merge pull request #5 in FREEPBX/arimanager from bugfix/FREEI-890-fix-xss-bootstrap-datatable-issues to release/13.0

* commit 'b48d2605e2214f5137867b6cf4854f9ce56ca669':
  FREEI-890 Fix XSS Bootstrap Datatable Issues
CVE-2020-26239: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Scratch Addons is a WebExtension that supports both Chrome and Firefox. Scratch Addons before version 1.3.2 is vulnerable to DOM-based XSS. If the victim visited a specific website, the More Links addon of the Scratch Addons extension used incorrect regular expression which caused the HTML-escaped values to be unescaped, leading to XSS. Scratch Addons version 1.3.2 fixes the bug. The extension will be automatically updated by the browser. More Links addon can be disabled via the option of the extension.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-11-23T19:15Z
Repository: https://github.com/ScratchAddons/ScratchAddons
Language: JavaScript
Files changed: addons/more-links/userscript.js
Commit date: 2020-11-23 23:56:17 +0900
Commit message: SECURITY: Fix DOM XSS in More Links addon

Diff: diff --git a/addons/more-links/userscript.js b/addons/more-links/userscript.js
index 211d721..79c08ef 100644
--- a/addons/more-links/userscript.js
+++ b/addons/more-links/userscript.js
@@ -13,11 +13,14 @@ export default async function ({ addon, console }) {
       (async () => {
         while (true) {
           let element = await addon.tab.waitForElement(".project-description", { markAsSeen: true });
           // Need to convert #[numbers] to solve conflict between tags and external Scratch player links.
           document.querySelectorAll(".project-description a").forEach((element) => {
-            if (/\d+/.test(element.textContent)) element.outerHTML = element.textContent;
+              if (/^#\d+$/.test(element.textContent) && element.previousSibling instanceof Text) {
+                  element.previousSibling.textContent += element.textContent;
+                  element.remove();
+              }
           });
           element.normalize();
           linkifyElement(element);
         }
       })();

Vulnerable code:             if (/\d+/.test(element.textContent)) element.outerHTML = element.textContent;
Fixed code:               if (/^#\d+$/.test(element.textContent) && element.previousSibling instanceof Text) {
                  element.previousSibling.textContent += element.textContent;
                  element.remove();
              }
CVE-2014-3576: Permissions, Privileges, and Access Controls (CWE-264)
value: The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 7.5
Published: 2015-08-14T18:59Z
Repository: https://github.com/apache/activemq
Language: Java
Files changed: activemq-broker/src/main/java/org/apache/activemq/broker/TransportConnection.java
Commit date: 2014-08-13 11:15:29 -0400
Commit message: Remove unused ConnectionControl handling. 
Diff: diff --git a/activemq-broker/src/main/java/org/apache/activemq/broker/TransportConnection.java b/activemq-broker/src/main/java/org/apache/activemq/broker/TransportConnection.java
index 22a63b8cf..5bb7ec1ec 100755
--- a/activemq-broker/src/main/java/org/apache/activemq/broker/TransportConnection.java
+++ b/activemq-broker/src/main/java/org/apache/activemq/broker/TransportConnection.java
@@ -1532,14 +1532,10 @@ public class TransportConnection implements Connection, Task, CommandVisitor {
         return protocolVersion.get();
     }
 
     @Override
     public Response processControlCommand(ControlCommand command) throws Exception {
-        String control = command.getCommand();
-        if (control != null && control.equals("shutdown")) {
-            System.exit(0);
-        }
         return null;
     }
 
     @Override
     public Response processMessageDispatch(MessageDispatch dispatch) throws Exception {

Vulnerable code:         String control = command.getCommand();
        if (control != null && control.equals("shutdown")) {
            System.exit(0);
        }
CVE-2019-10672: Improper Input Validation (CWE-20)
value: treeRead in hdf/btree.c in libmysofa before 0.7 does not properly validate multiplications and additions.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2019-03-31T17:29Z
Repository: https://github.com/hoene/libmysofa
Language: C
Files changed: src/hdf/btree.c
Commit date: 2019-03-31 15:57:14 +0200
Commit message: Fixed security issue 1

Diff: diff --git a/src/hdf/btree.c b/src/hdf/btree.c
index 41eb1ea..543da48 100644
--- a/src/hdf/btree.c
+++ b/src/hdf/btree.c
@@ -305,24 +305,24 @@ int treeRead(struct READER *reader, struct DATAOBJECT *data) {
 			switch (data->ds.dimensionality) {
 			case 1:
 				for (i = 0; i < olen; i++) {
 					b = i / elements;
 					x = i % elements + start[0];
-					if (x < sx) {
-						j = x * size + b;
+					j = x * size + b;
+					if (j>=0 && j < elements * size) {
 						((char*)data->data)[j] = output[i];
 					}
 				}
 				break;
 			case 2:
 				for (i = 0; i < olen; i++) {
 					b = i / elements;
 					x = i % elements;
 					y = x % dy + start[1];
 					x = x / dy + start[0];
-					if (y < sy && x < sx) {
-						j = ((x * sy + y) * size) + b;
+					j = ((x * sy + y) * size) + b;
+					if (j>=0 && j < elements * size) {
 						((char*)data->data)[j] = output[i];
 					}
 				}
 				break;
 			case 3:
@@ -330,12 +330,12 @@ int treeRead(struct READER *reader, struct DATAOBJECT *data) {
 					b = i / elements;
 					x = i % elements;
 					z = x % dz + start[2];
 					y = (x / dz) % dy + start[1];
 					x = (x / dzy) + start[0];
-					if (z < sz && y < sy && x < sx) {
-						j = (x * szy + y * sz + z) * size + b;
+					j = (x * szy + y * sz + z) * size + b;
+					if (j>=0 && j < elements * size) {
 						((char*)data->data)[j] = output[i];
 					}
 				}
 				break;
 			default:

Vulnerable code: 					if (x < sx) {
						j = x * size + b;
					if (y < sy && x < sx) {
						j = ((x * sy + y) * size) + b;
					if (z < sz && y < sy && x < sx) {
						j = (x * szy + y * sz + z) * size + b;
Fixed code: 					j = x * size + b;
					if (j>=0 && j < elements * size) {
					j = ((x * sy + y) * size) + b;
					if (j>=0 && j < elements * size) {
					j = (x * szy + y * sz + z) * size + b;
					if (j>=0 && j < elements * size) {
CVE-2019-20016: Out-of-bounds Write (CWE-787)
value: libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c. NOTE: a download of v0.9 after 2019-12-06 should fully remediate this issue.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2019-12-27T02:15Z
Repository: https://github.com/hoene/libmysofa
Language: C
Files changed: src/hdf/fractalhead.c, src/hdf/reader.h, src/hrtf/reader.c
Commit date: 2019-11-24 10:42:37 +0100
Commit message: Fixed recursive function calls

Diff: diff --git a/src/hdf/fractalhead.c b/src/hdf/fractalhead.c
index df4c6d5..dae61c8 100644
--- a/src/hdf/fractalhead.c
+++ b/src/hdf/fractalhead.c
@@ -31,16 +31,21 @@ static int directblockRead(struct READER *reader, struct DATAOBJECT *dataobject,
 
 	UNUSED(offset);
 	UNUSED(block_size);
 	UNUSED(block_offset);
 
+	if(reader->recursive_counter >= 10)
+		return MYSOFA_INVALID_FORMAT;
+	else
+		reader->recursive_counter++;
+
 	/* read signature */
 	if (fread(buf, 1, 4, reader->fhd) != 4 || strncmp(buf, "FHDB", 4)) {
 		log("cannot read signature of fractal heap indirect block\n");
 		return MYSOFA_INVALID_FORMAT;
 	}
-	log("%08" PRIX64 " %.4s\n", (uint64_t )ftell(reader->fhd) - 4, buf);
+	log("%08" PRIX64 " %.4s stack %d\n", (uint64_t )ftell(reader->fhd) - 4, buf, reader->recursive_counter);
 
 	if (fgetc(reader->fhd) != 0) {
 		log("object FHDB must have version 0\n");
 		return MYSOFA_UNSUPPORTED_FORMAT;
 	}
@@ -216,10 +221,11 @@ static int directblockRead(struct READER *reader, struct DATAOBJECT *dataobject,
 			return MYSOFA_OK;
 		}
 
 	} while (typeandversion != 0);
 
+	reader->recursive_counter--;
 	return MYSOFA_OK;
 }
 
 /*  III.G. Disk Format: Level 1G - Fractal Heap
  * indirect block
diff --git a/src/hdf/reader.h b/src/hdf/reader.h
index 41a9d92..3d5cceb 100644
--- a/src/hdf/reader.h
+++ b/src/hdf/reader.h
@@ -180,10 +180,12 @@ struct READER {
 	struct DATAOBJECT *all;
 
 	struct SUPERBLOCK superblock;
 
 	struct GCOL *gcol;
+
+	int recursive_counter;
 };
 
 int validAddress(struct READER *reader, uint64_t address);
 uint64_t readValue(struct READER *reader, int size);
 
diff --git a/src/hrtf/reader.c b/src/hrtf/reader.c
index a79e45b..396be7c 100644
--- a/src/hrtf/reader.c
+++ b/src/hrtf/reader.c
@@ -242,10 +242,11 @@ MYSOFA_EXPORT struct MYSOFA_HRTF* mysofa_load(const char *filename, int *err) {
 		*err = errno;
 		return NULL;
 	}
 	reader.gcol = NULL;
 	reader.all = NULL;
+	reader.recursive_counter = 0;
 
 	*err = superblockRead(&reader, &reader.superblock);
 
 	if (!*err) {
 		hrtf = getHrtf(&reader, err);

Vulnerable code: 	log("%08" PRIX64 " %.4s\n", (uint64_t )ftell(reader->fhd) - 4, buf);
Fixed code: 	if(reader->recursive_counter >= 10)
		return MYSOFA_INVALID_FORMAT;
	else
		reader->recursive_counter++;

	log("%08" PRIX64 " %.4s stack %d\n", (uint64_t )ftell(reader->fhd) - 4, buf, reader->recursive_counter);
	reader->recursive_counter--;

	int recursive_counter;
	reader.recursive_counter = 0;