Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-9109: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2018-03-28T06:29Z
Repository: https://github.com/Studio-42/elFinder
Language: PHP
Files changed: php/elFinder.class.php
Commit date: 2018-03-28 09:53:14 +0900
Commit message: [php:security] fix directory traversal vulnerability

Fixed vulnerability that can delete arbitrary files with zipdl command.

Fixed it because there was a possibility that files that can be deleted
may be deleted by the execution account of the web server.

Reviewed-by: Ravindra Rajaram <ravindra.rajaram@ca.com> and Kevin Kotas <kevin.kotas@ca.com>

Diff: diff --git a/php/elFinder.class.php b/php/elFinder.class.php
index 84b5852e..0ed8272f 100644
--- a/php/elFinder.class.php
+++ b/php/elFinder.class.php
@@ -1621,14 +1621,18 @@ class elFinder {
 			// 2nd: Return array contains opened file pointer, root itself and required headers
 			if (count($targets) !== 4 || ($volume = $this->volume($targets[0])) == false) {
 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
 			}
 			$file = $targets[1];
+			// checking the validity of the file parameter
+			if (strpos($file, DIRECTORY_SEPARATOR) !== false) {
+				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
+			}
 			$path = $volume->getTempPath().DIRECTORY_SEPARATOR.$file;
 			// register auto delete on shutdown
 			$GLOBALS['elFinderTempFiles'][$path] = true;
-			if (!is_readable($path)) {
+			if (!is_writable($path)) {
 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
 			}
 			$name = $targets[2];
 			$mime = $targets[3];
 			

Vulnerable code: 			if (!is_readable($path)) {
Fixed code: 			// checking the validity of the file parameter
			if (strpos($file, DIRECTORY_SEPARATOR) !== false) {
				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
			}
			if (!is_writable($path)) {
CVE-2018-9110: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2018-03-28T14:29Z
Repository: https://github.com/Studio-42/elFinder
Language: PHP
Files changed: php/elFinder.class.php
Commit date: 2018-03-28 14:31:53 +0900
Commit message: [php:security] re-fix directory traversal vulnerability for windows server

rel. commit 157f471d7e48f190f74e66eb5bc73360b5352fd3

Diff: diff --git a/php/elFinder.class.php b/php/elFinder.class.php
index bd2aa87a2..fec1143d8 100644
--- a/php/elFinder.class.php
+++ b/php/elFinder.class.php
@@ -1622,11 +1622,11 @@ class elFinder {
 			if (count($targets) !== 4 || ($volume = $this->volume($targets[0])) == false) {
 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
 			}
 			$file = $targets[1];
 			// checking the validity of the file parameter
-			if (strpos($file, DIRECTORY_SEPARATOR) !== false) {
+			if (strpos(str_replace('/', DIRECTORY_SEPARATOR, $file), DIRECTORY_SEPARATOR) !== false) {
 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
 			}
 			$path = $volume->getTempPath().DIRECTORY_SEPARATOR.$file;
 			// register auto delete on shutdown
 			$GLOBALS['elFinderTempFiles'][$path] = true;

Vulnerable code: 			if (strpos($file, DIRECTORY_SEPARATOR) !== false) {
Fixed code: 			if (strpos(str_replace('/', DIRECTORY_SEPARATOR, $file), DIRECTORY_SEPARATOR) !== false) {
CVE-2021-23394: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2021-06-13T11:15Z
Repository: https://github.com/Studio-42/elFinder
Language: PHP
Files changed: php/elFinderVolumeDriver.class.php
Commit date: 2021-05-31 20:50:39 +0900
Commit message: [VD:abstract] add `'phar:*' => 'text/x-php'` into 'staticMineMap'

rel. #3295

Diff: diff --git a/php/elFinderVolumeDriver.class.php b/php/elFinderVolumeDriver.class.php
index 3dd3389a3..b4e364a39 100644
--- a/php/elFinderVolumeDriver.class.php
+++ b/php/elFinderVolumeDriver.class.php
@@ -279,10 +279,11 @@ abstract class elFinderVolumeDriver
             'php3:*' => 'text/x-php',
             'php4:*' => 'text/x-php',
             'php5:*' => 'text/x-php',
             'php7:*' => 'text/x-php',
             'phtml:*' => 'text/x-php',
+            'phar:*' => 'text/x-php',
             'cgi:*' => 'text/x-httpd-cgi',
             'pl:*' => 'text/x-perl',
             'asp:*' => 'text/x-asap',
             'aspx:*' => 'text/x-asap',
             'py:*' => 'text/x-python',

Fixed code:             'phar:*' => 'text/x-php',
CVE-2023-35840: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: _joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2023-06-19T01:15Z
Repository: https://github.com/Studio-42/elFinder
Language: PHP
Files changed: php/elFinderVolumeLocalFileSystem.class.php
Commit date: 2023-06-02 00:04:05 +0900
Commit message: [VD:LocalFileSystem] Security fixes, directory traversal vulnerability
fixes

This issue was found by Michał Majchrowicz & Livio Victoriano AFINE
Team. We give them a special thanks.

Diff: diff --git a/php/elFinderVolumeLocalFileSystem.class.php b/php/elFinderVolumeLocalFileSystem.class.php
index ce2186b990..481b1a45b6 100644
--- a/php/elFinderVolumeLocalFileSystem.class.php
+++ b/php/elFinderVolumeLocalFileSystem.class.php
@@ -371,13 +371,17 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver
         $dir = rtrim($dir, DIRECTORY_SEPARATOR);
         $path = realpath($dir . DIRECTORY_SEPARATOR . $name);
         // realpath() returns FALSE if the file does not exist
         if ($path === false || strpos($path, $this->root) !== 0) {
             if (DIRECTORY_SEPARATOR !== '/') {
+                $dir = str_replace('/', DIRECTORY_SEPARATOR, $dir);
                 $name = str_replace('/', DIRECTORY_SEPARATOR, $name);
             }
             // Directory traversal measures
+            if (strpos($dir, '..' . DIRECTORY_SEPARATOR) !== false || substr($dir, -2) == '..') {
+                $dir = $this->root;
+            }
             if (strpos($name, '..' . DIRECTORY_SEPARATOR) !== false) {
                 $name = basename($name);
             }
             $path = $dir . DIRECTORY_SEPARATOR . $name;
         }

Fixed code:                 $dir = str_replace('/', DIRECTORY_SEPARATOR, $dir);
            if (strpos($dir, '..' . DIRECTORY_SEPARATOR) !== false || substr($dir, -2) == '..') {
                $dir = $this->root;
            }
CVE-1999-0731: Other (NVD-CWE-Other)
value: The KDE klock program allows local users to unlock a session using malformed input.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 1999-06-23T04:00Z
Repository: https://github.com/KDE/kde1-kdebase
Language: C++
Files changed: kscreensaver/saver.cpp
Commit date: 1999-06-24 11:38:11 +0000
Commit message: Fix for password entry/dialog deletion race.

Diff: diff --git a/kscreensaver/saver.cpp b/kscreensaver/saver.cpp
index d4d84d1ef..1bf737be1 100644
--- a/kscreensaver/saver.cpp
+++ b/kscreensaver/saver.cpp
@@ -149,10 +149,11 @@ void KPasswordDlg::keyPressed( QKeyEvent *e )
 				}
 			}
 			break;
 
 		case Key_Return:
+            timer.stop();
 			waitForAuthentication = true;
 			if ( tryPassword() )
 				emit passOk();
 			else
 			{

Fixed code:             timer.stop();
CVE-2018-16426: Uncontrolled Recursion (CWE-674)
value: Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.
CWE description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
CVSS v3 base score: 4.3
Published: 2018-09-04T00:29Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/card-iasecc.c
Commit date: 2018-08-14 16:13:22 +0200
Commit message: iasecc: fixed unbound recursion

Diff: diff --git a/src/libopensc/card-iasecc.c b/src/libopensc/card-iasecc.c
index 48d4cea56..b37b833b7 100644
--- a/src/libopensc/card-iasecc.c
+++ b/src/libopensc/card-iasecc.c
@@ -825,20 +825,20 @@ iasecc_select_file(struct sc_card *card, const struct sc_path *path,
 	       "iasecc_select_file(card:%p) path.len %"SC_FORMAT_LEN_SIZE_T"u; path.type %i; aid_len %"SC_FORMAT_LEN_SIZE_T"u",
 	       card, path->len, path->type, path->aid.len);
 	sc_log(ctx, "iasecc_select_file() path:%s", sc_print_path(path));
 
 	sc_print_cache(card);
-	if (lpath.len >= 2 && lpath.value[0] == 0x3F && lpath.value[1] == 0x00)   {
+	if (path->type != SC_PATH_TYPE_DF_NAME
+			&& lpath.len >= 2
+			&& lpath.value[0] == 0x3F && lpath.value[1] == 0x00)   {
 		sc_log(ctx, "EF.ATR(aid:'%s')", card->ef_atr ? sc_dump_hex(card->ef_atr->aid.value, card->ef_atr->aid.len) : "");
 
 		rv = iasecc_select_mf(card, file_out);
 		LOG_TEST_RET(ctx, rv, "MF selection error");
 
-		if (lpath.len >= 2 && lpath.value[0] == 0x3F && lpath.value[1] == 0x00)	   {
-			memmove(&lpath.value[0], &lpath.value[2], lpath.len - 2);
-			lpath.len -=  2;
-		}
+		memmove(&lpath.value[0], &lpath.value[2], lpath.len - 2);
+		lpath.len -=  2;
 	}
 
 	if (lpath.aid.len)	{
 		struct sc_file *file = NULL;
 		struct sc_path ppath;

Vulnerable code: 	if (lpath.len >= 2 && lpath.value[0] == 0x3F && lpath.value[1] == 0x00)   {
		if (lpath.len >= 2 && lpath.value[0] == 0x3F && lpath.value[1] == 0x00)	   {
			memmove(&lpath.value[0], &lpath.value[2], lpath.len - 2);
			lpath.len -=  2;
		}
Fixed code: 	if (path->type != SC_PATH_TYPE_DF_NAME
			&& lpath.len >= 2
			&& lpath.value[0] == 0x3F && lpath.value[1] == 0x00)   {
		memmove(&lpath.value[0], &lpath.value[2], lpath.len - 2);
		lpath.len -=  2;
CVE-2019-15945: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.4
Published: 2019-09-05T17:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/asn1.c
Commit date: 2019-08-27 15:19:22 +0200
Commit message: fixed out of bounds access of ASN.1 Bitstring

Credit to OSS-Fuzz

Diff: diff --git a/src/libopensc/asn1.c b/src/libopensc/asn1.c
index 47b42c746..296ad5eca 100644
--- a/src/libopensc/asn1.c
+++ b/src/libopensc/asn1.c
@@ -568,20 +568,24 @@ const u8 *sc_asn1_verify_tag(sc_context_t *ctx, const u8 * buf, size_t buflen,
 static int decode_bit_string(const u8 * inbuf, size_t inlen, void *outbuf,
 			     size_t outlen, int invert)
 {
 	const u8 *in = inbuf;
 	u8 *out = (u8 *) outbuf;
-	int zero_bits = *in & 0x07;
-	size_t octets_left = inlen - 1;
 	int i, count = 0;
+	int zero_bits;
+	size_t octets_left;
 
-	memset(outbuf, 0, outlen);
-	in++;
 	if (outlen < octets_left)
 		return SC_ERROR_BUFFER_TOO_SMALL;
 	if (inlen < 1)
 		return SC_ERROR_INVALID_ASN1_OBJECT;
+
+	zero_bits = *in & 0x07;
+	octets_left = inlen - 1;
+	in++;
+	memset(outbuf, 0, outlen);
+
 	while (octets_left) {
 		/* 1st octet of input:  ABCDEFGH, where A is the MSB */
 		/* 1st octet of output: HGFEDCBA, where A is the LSB */
 		/* first bit in bit string is the LSB in first resulting octet */
 		int bits_to_go;

Vulnerable code: 	int zero_bits = *in & 0x07;
	size_t octets_left = inlen - 1;
	memset(outbuf, 0, outlen);
	in++;
Fixed code: 	int zero_bits;
	size_t octets_left;

	zero_bits = *in & 0x07;
	octets_left = inlen - 1;
	in++;
	memset(outbuf, 0, outlen);
CVE-2019-15946: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.4
Published: 2019-09-05T17:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/asn1.c
Commit date: 2019-08-27 15:21:46 +0200
Commit message: Fixed out of bounds access in ASN.1 Octet string

Credit to OSS-Fuzz

Diff: diff --git a/src/libopensc/asn1.c b/src/libopensc/asn1.c
index 296ad5eca..77ed4d7b7 100644
--- a/src/libopensc/asn1.c
+++ b/src/libopensc/asn1.c
@@ -1467,11 +1467,11 @@ static int asn1_decode_entry(sc_context_t *ctx,struct sc_asn1_entry *entry,
 			size_t c;
 			assert(len != NULL);
 
 			/* Strip off padding zero */
 			if ((entry->flags & SC_ASN1_UNSIGNED)
-			 && obj[0] == 0x00 && objlen > 1) {
+					&& objlen > 1 && obj[0] == 0x00) {
 				objlen--;
 				obj++;
 			}
 
 			/* Allocate buffer if needed */

Vulnerable code: 			 && obj[0] == 0x00 && objlen > 1) {
Fixed code: 					&& objlen > 1 && obj[0] == 0x00) {
CVE-2019-19479: Out-of-bounds Read (CWE-125)
value: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2019-12-01T23:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/card-setcos.c
Commit date: 2019-11-03 04:45:28 +0100
Commit message: fixed  UNKNOWN READ

Reported by OSS-Fuzz
https://oss-fuzz.com/testcase-detail/5681169970757632

Diff: diff --git a/src/libopensc/card-setcos.c b/src/libopensc/card-setcos.c
index 4cf328ad6..1b4e8f3e2 100644
--- a/src/libopensc/card-setcos.c
+++ b/src/libopensc/card-setcos.c
@@ -866,11 +866,11 @@ static void parse_sec_attr_44(sc_file_t *file, const u8 *buf, size_t len)
 				p_idx = ef_idx;
 				break;
 			}
 
 			/* Encryption key present ? */
-			iPinCount = iACLen - 1;		
+			iPinCount = iACLen > 0 ? iACLen - 1 : 0;
 
 			if (buf[iOffset] & 0x20) {
 				int iSC;
 				if (len < 1 + (size_t)iACLen)
 					break;

Vulnerable code: 			iPinCount = iACLen - 1;		
Fixed code: 			iPinCount = iACLen > 0 ? iACLen - 1 : 0;
CVE-2019-19480: Operation on a Resource after Expiration or Release (CWE-672)
value: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry.
CWE description: The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CVSS v3 base score: 4.6
Published: 2019-12-01T23:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/pkcs15-prkey.c
Commit date: 2019-10-23 13:50:52 +0200
Commit message: pkcs15-prkey: Simplify cleaning memory after failure

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18478

Diff: diff --git a/src/libopensc/pkcs15-prkey.c b/src/libopensc/pkcs15-prkey.c
index 228a7b3dc..a4f4a4101 100644
--- a/src/libopensc/pkcs15-prkey.c
+++ b/src/libopensc/pkcs15-prkey.c
@@ -258,14 +258,11 @@ int sc_pkcs15_decode_prkdf_entry(struct sc_pkcs15_card *p15card,
 	memset(gostr3410_params, 0, sizeof(gostr3410_params));
 
 	r = sc_asn1_decode_choice(ctx, asn1_prkey, *buf, *buflen, buf, buflen);
 	if (r < 0) {
 		/* This might have allocated something. If so, clear it now */
-		if (asn1_com_prkey_attr->flags & SC_ASN1_PRESENT &&
-			asn1_com_prkey_attr[0].flags & SC_ASN1_PRESENT) {
-			free(asn1_com_prkey_attr[0].parm);
-		}
+		free(info.subject.value);
 	}
 	if (r == SC_ERROR_ASN1_END_OF_CONTENTS)
 		return r;
 	LOG_TEST_RET(ctx, r, "PrKey DF ASN.1 decoding failed");
 	if (asn1_prkey[0].flags & SC_ASN1_PRESENT) {

Vulnerable code: 		if (asn1_com_prkey_attr->flags & SC_ASN1_PRESENT &&
			asn1_com_prkey_attr[0].flags & SC_ASN1_PRESENT) {
			free(asn1_com_prkey_attr[0].parm);
		}
Fixed code: 		free(info.subject.value);
CVE-2019-19481: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC certificates.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 4.6
Published: 2019-12-01T23:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/card-cac1.c
Commit date: 2019-11-01 15:53:40 +0100
Commit message: cac1: Correctly handle the buffer limits

Found by oss-fuzz

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18618
and others

Diff: diff --git a/src/libopensc/card-cac1.c b/src/libopensc/card-cac1.c
index 90495a7a7..08d62b62c 100644
--- a/src/libopensc/card-cac1.c
+++ b/src/libopensc/card-cac1.c
@@ -67,21 +67,20 @@ static int cac_cac1_get_certificate(sc_card_t *card, u8 **out_buf, size_t *out_l
 {
 	u8 buf[CAC_MAX_SIZE];
 	u8 *out_ptr;
 	size_t size = 0;
 	size_t left = 0;
-	size_t len, next_len;
+	size_t len;
 	sc_apdu_t apdu;
 	int r = SC_SUCCESS;
 	SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_VERBOSE);
 	/* get the size */
 	size = left = *out_buf ? *out_len : sizeof(buf);
 	out_ptr = *out_buf ? *out_buf : buf;
 	sc_format_apdu(card, &apdu, SC_APDU_CASE_2_SHORT, CAC_INS_GET_CERTIFICATE, 0, 0 );
-	next_len = MIN(left, 100);
-	for (; left > 0; left -= len, out_ptr += len) {
-		len = next_len;
+	len = MIN(left, 100);
+	for (; left > 0;) { /* Increments for readability in the end of the function */
 		apdu.resp = out_ptr;
 		apdu.le = len;
 		apdu.resplen = left;
 		r = sc_transmit_apdu(card, &apdu);
 		if (r < 0) {
@@ -96,11 +95,14 @@ static int cac_cac1_get_certificate(sc_card_t *card, u8 **out_buf, size_t *out_l
 			/* we've either finished reading, or hit an error, break */
 			r = sc_check_sw(card, apdu.sw1, apdu.sw2);
 			left -= len;
 			break;
 		}
-		next_len = MIN(left, apdu.sw2);
+		/* Adjust the lengths */
+		left -= len;
+		out_ptr += len;
+		len = MIN(left, apdu.sw2);
 	}
 	if (r < 0) {
 		SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, r);
 	}
 	r = size - left;
@@ -126,11 +128,11 @@ static int cac_read_binary(sc_card_t *card, unsigned int idx,
 {
 	cac_private_data_t * priv = CAC_DATA(card);
 	int r = 0;
 	u8 *val = NULL;
 	u8 *cert_ptr;
-	size_t val_len;
+	size_t val_len = 0;
 	size_t len, cert_len;
 	u8 cert_type;
 
 	SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_VERBOSE);
 

Vulnerable code: 	size_t len, next_len;
	next_len = MIN(left, 100);
	for (; left > 0; left -= len, out_ptr += len) {
		len = next_len;
		next_len = MIN(left, apdu.sw2);
	size_t val_len;
Fixed code: 	size_t len;
	len = MIN(left, 100);
	for (; left > 0;) { /* Increments for readability in the end of the function */
		/* Adjust the lengths */
		left -= len;
		out_ptr += len;
		len = MIN(left, apdu.sw2);
	size_t val_len = 0;
CVE-2019-20792: Double Free (CWE-415)
value: OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 6.8
Published: 2020-04-29T04:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/card-coolkey.c
Commit date: 2019-12-04 21:47:47 +0100
Commit message: coolkey: Make sure the object ID is unique when filling list

Thanks to oss-fuzz

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19208

Diff: diff --git a/src/libopensc/card-coolkey.c b/src/libopensc/card-coolkey.c
index d492d71558..c95a503589 100644
--- a/src/libopensc/card-coolkey.c
+++ b/src/libopensc/card-coolkey.c
@@ -1943,10 +1943,15 @@ coolkey_add_object(coolkey_private_data_t *priv, unsigned long object_id, const
 	new_object.path.len = 4;
 	ulong2bebytes(new_object.path.value, object_id);
 	new_object.id = object_id;
 	new_object.length = object_length;
 
+	/* The object ID needs to be unique */
+	if (coolkey_find_object_by_id(&priv->objects_list, object_id) != NULL) {
+		return SC_ERROR_INTERNAL;
+	}
+
 	if (object_data) {
 		new_object.data = malloc(object_length + add_v1_record);
 		if (new_object.data == NULL) {
 			return SC_ERROR_OUT_OF_MEMORY;
 		}

Fixed code: 	/* The object ID needs to be unique */
	if (coolkey_find_object_by_id(&priv->objects_list, object_id) != NULL) {
		return SC_ERROR_INTERNAL;
	}
CVE-2020-26570: Out-of-bounds Write (CWE-787)
value: The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-10-06T02:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/pkcs15-oberthur.c
Commit date: 2020-07-30 02:27:02 +0200
Commit message: Heap-buffer-overflow WRITE

fixes https://oss-fuzz.com/testcase-detail/5088104168554496

Diff: diff --git a/src/libopensc/pkcs15-oberthur.c b/src/libopensc/pkcs15-oberthur.c
index a873aaa0dd..2fb32b8dba 100644
--- a/src/libopensc/pkcs15-oberthur.c
+++ b/src/libopensc/pkcs15-oberthur.c
@@ -269,15 +269,19 @@ sc_oberthur_read_file(struct sc_pkcs15_card *p15card, const char *in_path,
 
 	if (file->ef_structure == SC_FILE_EF_TRANSPARENT)   {
 		rv = sc_read_binary(card, 0, *out, sz, 0);
 	}
 	else	{
-		int rec;
-		int offs = 0;
-		int rec_len = file->record_length;
+		size_t rec;
+		size_t offs = 0;
+		size_t rec_len = file->record_length;
 
 		for (rec = 1; ; rec++)   {
+			if (rec > file->record_count) {
+				rv = 0;
+				break;
+			}
 			rv = sc_read_record(card, rec, *out + offs + 2, rec_len, SC_RECORD_BY_REC_NR);
 			if (rv == SC_ERROR_RECORD_NOT_FOUND)   {
 				rv = 0;
 				break;
 			}

Vulnerable code: 		int rec;
		int offs = 0;
		int rec_len = file->record_length;
Fixed code: 		size_t rec;
		size_t offs = 0;
		size_t rec_len = file->record_length;
			if (rec > file->record_count) {
				rv = 0;
				break;
			}
CVE-2020-26572: Out-of-bounds Write (CWE-787)
value: The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-10-06T02:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/card-tcos.c
Commit date: 2020-06-04 10:04:10 +0200
Commit message: prevent out of bounds write

fixes https://oss-fuzz.com/testcase-detail/5226571123392512

Diff: diff --git a/src/libopensc/card-tcos.c b/src/libopensc/card-tcos.c
index 673c2493dd..e88c80bd79 100644
--- a/src/libopensc/card-tcos.c
+++ b/src/libopensc/card-tcos.c
@@ -621,10 +621,12 @@ static int tcos_decipher(sc_card_t *card, const u8 * crgram, size_t crgram_len,
 	apdu.le = crgram_len;
 
 	apdu.data = sbuf;
 	apdu.lc = apdu.datalen = crgram_len+1;
 	sbuf[0] = tcos3 ? 0x00 : ((data->pad_flags & SC_ALGORITHM_RSA_PAD_PKCS1) ? 0x81 : 0x02);
+	if (sizeof sbuf - 1 < crgram_len)
+		return SC_ERROR_INVALID_ARGUMENTS;
 	memcpy(sbuf+1, crgram, crgram_len);
 
 	r = sc_transmit_apdu(card, &apdu);
 	LOG_TEST_RET(card->ctx, r, "APDU transmit failed");
 

Fixed code: 	if (sizeof sbuf - 1 < crgram_len)
		return SC_ERROR_INVALID_ARGUMENTS;
CVE-2023-4535: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 3.8
Published: 2023-11-06T17:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/libopensc/card-myeid.c
Commit date: 2023-07-03 21:05:28 +0200
Commit message: myeid: fixed CID 380538  Out-of-bounds read (OVERRUN)

also fixes output buffer size checking

Diff: diff --git a/src/libopensc/card-myeid.c b/src/libopensc/card-myeid.c
index 4ee4246840..50e78ff1d8 100644
--- a/src/libopensc/card-myeid.c
+++ b/src/libopensc/card-myeid.c
@@ -1984,22 +1984,24 @@ myeid_enc_dec_sym(struct sc_card *card, const u8 *data, size_t datalen,
 				uint8_t i, pad_byte = *(priv->sym_plain_buffer + block_size - 1);
 
 				sc_log(ctx, "Found padding byte %02x", pad_byte);
 				if (pad_byte == 0 || pad_byte > block_size)
 					LOG_FUNC_RETURN(ctx, SC_ERROR_WRONG_PADDING);
-				sdata = priv->sym_plain_buffer + block_size - pad_byte;
+				sdata = priv->sym_plain_buffer + block_size;
 				for (i = 0; i < pad_byte; i++)
-					if (sdata[i] != pad_byte)
+					if (*(--sdata) != pad_byte)
 						LOG_FUNC_RETURN(ctx, SC_ERROR_WRONG_PADDING);
 				return_len = block_size - pad_byte;
 			}
-			*outlen = return_len;
 			/* application can request buffer size or actual buffer size is too small */
-			if (out == NULL)
+			if (out == NULL) {
+				*outlen = return_len;
 				LOG_FUNC_RETURN(ctx, SC_SUCCESS);
+			}
 			if (return_len > *outlen)
 				LOG_FUNC_RETURN(ctx, SC_ERROR_BUFFER_TOO_SMALL);
+			*outlen = return_len;
 			memcpy(out, priv->sym_plain_buffer, return_len);
 			sc_log(ctx, "C_DecryptFinal %zu bytes", *outlen);
 			return SC_SUCCESS;
 		} else {
 			/* C_EncryptFinalize */

Vulnerable code: 				sdata = priv->sym_plain_buffer + block_size - pad_byte;
					if (sdata[i] != pad_byte)
			*outlen = return_len;
			if (out == NULL)
Fixed code: 				sdata = priv->sym_plain_buffer + block_size;
					if (*(--sdata) != pad_byte)
			if (out == NULL) {
				*outlen = return_len;
			}
			*outlen = return_len;
CVE-2024-1454: Use After Free (CWE-416)
value: The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Published: 2024-02-12T23:15Z
Repository: https://github.com/OpenSC/OpenSC
Language: C
Files changed: src/pkcs15init/pkcs15-authentic.c
Commit date: 2023-12-20 11:37:49 +0100
Commit message: authentic: Avoid use after free

Thanks oss-fuzz

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898

Diff: diff --git a/src/pkcs15init/pkcs15-authentic.c b/src/pkcs15init/pkcs15-authentic.c
index a6d8b8ffad..798bc44138 100644
--- a/src/pkcs15init/pkcs15-authentic.c
+++ b/src/pkcs15init/pkcs15-authentic.c
@@ -866,11 +866,11 @@ authentic_emu_update_tokeninfo(struct sc_profile *profile, struct sc_pkcs15_card
 
 	sc_format_path(AUTHENTIC_CACHE_TIMESTAMP_PATH, &path);
 	rv = sc_select_file(p15card->card, &path, &file);
 	if (!rv) {
 		rv = sc_get_challenge(p15card->card, buffer, sizeof(buffer));
-		if (!rv) {
+		if (rv < 0) {
 			sc_file_free(file);
 			LOG_TEST_RET(ctx, rv, "Get challenge error");
 		}
 
 		len = file->size > sizeof(buffer) ? sizeof(buffer) : file->size;

Vulnerable code: 		if (!rv) {
Fixed code: 		if (rv < 0) {
CVE-2022-23650: Use of Hard-coded Credentials (CWE-798)
value: Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 8.8
Published: 2022-02-18T22:15Z
Repository: https://github.com/gravitl/netmaker
Language: Unknown
Commit date: 2022-02-15 10:04:22 -0500
Commit message: Merge pull request #770 from gravitl/hotfix_v0.10.0_jwt_data

added jwt fix
CVE-2023-32077: Use of Hard-coded Credentials (CWE-798)
value: Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6.  If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 7.5
Published: 2023-08-24T22:15Z
Repository: https://github.com/gravitl/netmaker
Language: Go
Files changed: logic/security.go, servercfg/serverconf.go
Commit date: 2023-04-03 14:17:14 -0400
Commit message: fixed hard coded dns key

Diff: diff --git a/logic/security.go b/logic/security.go
index 1b57dc8b..a6b13dbb 100644
--- a/logic/security.go
+++ b/logic/security.go
@@ -185,11 +185,11 @@ func authenticateNetworkUser(network string, userNetworks []string) bool {
 func authenticateDNSToken(tokenString string) bool {
 	tokens := strings.Split(tokenString, " ")
 	if len(tokens) < 2 {
 		return false
 	}
-	return tokens[1] == servercfg.GetDNSKey()
+	return len(servercfg.GetDNSKey()) > 0 && tokens[1] == servercfg.GetDNSKey()
 }
 
 func ContinueIfUserMatch(next http.Handler) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		var errorResponse = models.ErrorResponse{
diff --git a/servercfg/serverconf.go b/servercfg/serverconf.go
index c59253d9..1830cb66 100644
--- a/servercfg/serverconf.go
+++ b/servercfg/serverconf.go
@@ -275,11 +275,11 @@ func GetMasterKey() string {
 	return key
 }
 
 // GetDNSKey - gets the configured dns key of server
 func GetDNSKey() string {
-	key := "secretkey"
+	key := ""
 	if os.Getenv("DNS_KEY") != "" {
 		key = os.Getenv("DNS_KEY")
 	} else if config.Config.Server.DNSKey != "" {
 		key = config.Config.Server.DNSKey
 	}

Vulnerable code: 	return tokens[1] == servercfg.GetDNSKey()
	key := "secretkey"
Fixed code: 	return len(servercfg.GetDNSKey()) > 0 && tokens[1] == servercfg.GetDNSKey()
	key := ""
CVE-2023-32077: Use of Hard-coded Credentials (CWE-798)
value: Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6.  If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 7.5
Published: 2023-08-24T22:15Z
Repository: https://github.com/gravitl/netmaker
Language: Unknown
Commit date: 2023-04-04 08:23:11 -0400
Commit message: Merge pull request #2170 from gravitl/GRA-1493/dns-key

GRA-1493: fixed hard coded dns key
CVE-2023-32078: Authorization Bypass Through User-Controlled Key (CWE-639)
value: Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 7.5
Published: 2023-08-24T22:15Z
Repository: https://github.com/gravitl/netmaker
Language: Unknown
Commit date: 2023-04-04 16:08:34 -0400
Commit message: Merge pull request #2158 from gravitl/GRA-1479-user-updates

add checks to user update processing
CVE-2020-7760: Uncontrolled Resource Consumption (CWE-400)
value: This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2020-10-30T11:15Z
Repository: https://github.com/codemirror/CodeMirror
Language: JavaScript
Files changed: mode/javascript/javascript.js
Commit date: 2020-10-09 15:38:39 +0200
Commit message: [javascript mode] Fix potentially-exponential regexp

Diff: diff --git a/mode/javascript/javascript.js b/mode/javascript/javascript.js
index 66e5a308..3139fd00 100644
--- a/mode/javascript/javascript.js
+++ b/mode/javascript/javascript.js
@@ -124,11 +124,11 @@ CodeMirror.defineMode("javascript", function(config, parserConfig) {
       if (state.lastType != ".") {
         if (keywords.propertyIsEnumerable(word)) {
           var kw = keywords[word]
           return ret(kw.type, kw.style, word)
         }
-        if (word == "async" && stream.match(/^(\s|\/\*.*?\*\/)*[\[\(\w]/, false))
+        if (word == "async" && stream.match(/^(\s|\/\*([^*]|\*(?!\/))*?\*\/)*[\[\(\w]/, false))
           return ret("async", "keyword", word)
       }
       return ret("variable", "variable", word)
     }
   }

Vulnerable code:         if (word == "async" && stream.match(/^(\s|\/\*.*?\*\/)*[\[\(\w]/, false))
Fixed code:         if (word == "async" && stream.match(/^(\s|\/\*([^*]|\*(?!\/))*?\*\/)*[\[\(\w]/, false))
CVE-2021-35206: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Gitpod before 0.6.0 allows unvalidated redirects.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2021-06-22T14:15Z
Repository: https://github.com/gitpod-io/gitpod
Language: TypeScript
Files changed: components/server/src/user/user-controller.ts
Commit date: 2021-01-13 14:45:04 +0100
Commit message: [server/auth] ensure safe returnTo param

Diff: diff --git a/components/server/src/user/user-controller.ts b/components/server/src/user/user-controller.ts
index c6296442..bd3b6859 100644
--- a/components/server/src/user/user-controller.ts
+++ b/components/server/src/user/user-controller.ts
@@ -79,17 +79,19 @@ export class UserController {
                 log.error(`Login failed due to session save error; redirecting to /sorry`, { req, error, clientInfo });
                 res.redirect(this.getSorryUrl("Login failed 🦄 Please try again"));
             }
 
             // Proceed with login
+            this.ensureSafeReturnToParam(req);
             await this.authenticator.authenticate(req, res, next);
         });
         router.get("/authorize", (req: express.Request, res: express.Response, next: express.NextFunction) => {
             if (!User.is(req.user)) {
                 res.sendStatus(401);
                 return;
             }
+            this.ensureSafeReturnToParam(req);
             this.authenticator.authorize(req, res, next);
         });
         const branding = this.env.brandingConfig;
         router.get("/logout", async (req: express.Request, res: express.Response, next: express.NextFunction) => {
             const logContext = LogContext.from({ user: req.user, request: req });
@@ -481,10 +483,14 @@ export class UserController {
                 return;
             }
         }
     }
 
+    protected ensureSafeReturnToParam(req: express.Request) {
+        req.query.returnTo = this.getSafeReturnToParam(req);
+    }
+
     protected getSafeReturnToParam(req: express.Request) {
         const returnToURL: string | undefined = req.query.redirect || req.query.returnTo;
         if (returnToURL) {
             const hostUrl = this.env.hostUrl.url as URL;
             if (returnToURL.toLowerCase().startsWith(`${hostUrl.protocol}//${hostUrl.host}`.toLowerCase())) {

Fixed code:             this.ensureSafeReturnToParam(req);
            this.ensureSafeReturnToParam(req);
    protected ensureSafeReturnToParam(req: express.Request) {
        req.query.returnTo = this.getSafeReturnToParam(req);
    }
CVE-2024-34354: Insufficient Information (NVD-CWE-noinfo)
value: CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:38Z
Repository: https://github.com/CriticalMoments/CMSaasStarter
Language: Unknown
Commit date: 2024-05-09 10:29:33 -0400
Commit message: Merge pull request #65 from CriticalMoments/safe_get_session

Fix a security issue: https://github.com/supabase/supabase/pull/22381
CVE-2010-2809: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an HTML document.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Published: 2010-08-19T22:00Z
Repository: https://github.com/Dieterbe/uzbl
Language: Other
Files changed: examples/config/config
Commit date: 2010-08-05 13:12:27 +0200
Commit message: Don't shell-interpret \@SELECTED_URI (fixes FS#240)

Diff: diff --git a/examples/config/config b/examples/config/config
index cff13ad1..da2c583d 100644
--- a/examples/config/config
+++ b/examples/config/config
@@ -171,11 +171,11 @@ set ebind     = @mode_bind global,-insert
 @ebind  <Ctrl>e      = event SET_CURSOR_POS -1
 
 # --- Mouse bindings ---------------------------------------------------------
 
 # Middle click open in new window
-@bind  <Button2>  = sh 'if [ "\@SELECTED_URI" ]; then uzbl-browser -u "\@SELECTED_URI"; else echo "uri $(xclip -o | sed s/\\\@/%40/g)" > $4; fi'
+@bind  <Button2>  = sh 'if [ "$8" ]; then uzbl-browser -u "$8"; else echo "uri $(xclip -o | sed s/\\\@/%40/g)" > $4; fi' \@SELECTED_URI
 
 # --- Keyboard bindings ------------------------------------------------------
 
 # With this command you can enter in any command at runtime when prefixed with
 # a colon.

Vulnerable code: @bind  <Button2>  = sh 'if [ "\@SELECTED_URI" ]; then uzbl-browser -u "\@SELECTED_URI"; else echo "uri $(xclip -o | sed s/\\\@/%40/g)" > $4; fi'
Fixed code: @bind  <Button2>  = sh 'if [ "$8" ]; then uzbl-browser -u "$8"; else echo "uri $(xclip -o | sed s/\\\@/%40/g)" > $4; fi' \@SELECTED_URI
CVE-2021-4295: Improper Restriction of XML External Entity Reference (CWE-611)
value: A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2022-12-29T09:15Z
Repository: https://github.com/onc-healthit/code-validator-api
Language: Unknown
Commit date: 2021-07-29 18:11:09 -0400
Commit message: Merge pull request #97 from radiovideo/XXE-vulnerability-fix

Fix DocumentBuilderFactory XXE vulnerability
CVE-2017-5603: Improper Input Validation (CWE-20)
value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.9
Published: 2017-02-09T20:59Z
Repository: https://github.com/jitsi/jitsi
Language: Java
Files changed: src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java
Commit date: 2017-01-26 17:00:46 -0600
Commit message: Checks from for received carbon messages, should be bare jid.

Diff: diff --git a/src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java b/src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java
index f05561337..2f35fef97 100644
--- a/src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java
+++ b/src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java
@@ -813,10 +813,21 @@ public void processPacket(Packet packet)
                 List<ForwardedPacketExtension> extensions
                     = carbonExt.getChildExtensionsOfType(
                         ForwardedPacketExtension.class);
                 if(extensions.isEmpty())
                     return;
+
+                // according to xep-0280 all carbons should come from
+                // our bare jid
+                if (!msg.getFrom().equals(
+                        StringUtils.parseBareAddress(
+                            jabberProvider.getOurJID())))
+                {
+                    logger.info("Received a carbon copy with wrong from!");
+                    return;
+                }
+
                 ForwardedPacketExtension forwardedExt = extensions.get(0);
                 msg = forwardedExt.getMessage();
                 if(msg == null || msg.getBody() == null)
                     return;
 

Fixed code: 
                // according to xep-0280 all carbons should come from
                // our bare jid
                if (!msg.getFrom().equals(
                        StringUtils.parseBareAddress(
                            jabberProvider.getOurJID())))
                {
                    logger.info("Received a carbon copy with wrong from!");
                    return;
                }