Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2013-7262: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2014-01-05T20:55Z
Repository: https://github.com/mapserver/mapserver
Language: C
Files changed: mappostgis.c
Commit date: 2013-12-31 13:55:03 +0100
Commit message: Fix potential SQL Injection with postgis TIME filters (#4834)

Diff: diff --git a/mappostgis.c b/mappostgis.c
index 1f4c64eb..f24d9697 100644
--- a/mappostgis.c
+++ b/mappostgis.c
@@ -3210,10 +3210,15 @@ int msPostGISLayerSetTimeFilter(layerObj *lp, const char *timestring, const char
   bufferTmp[0] = '\0';
 
   if (!lp || !timestring || !timefield)
     return MS_FALSE;
 
+  if( strchr(timestring,'\'') || strchr(timestring, '\\') ) {
+     msSetError(MS_MISCERR, "Invalid time filter.", "msPostGISLayerSetTimeFilter()");
+     return MS_FALSE;
+  }
+
   /* discrete time */
   if (strstr(timestring, ",") == NULL &&
       strstr(timestring, "/") == NULL) { /* discrete time */
     createPostgresTimeCompareSimple(timefield, timestring, buffer, buffer_size);
   } else {

Fixed code:   if( strchr(timestring,'\'') || strchr(timestring, '\\') ) {
     msSetError(MS_MISCERR, "Invalid time filter.", "msPostGISLayerSetTimeFilter()");
     return MS_FALSE;
  }
CVE-2017-5522: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-03-15T16:59Z
Repository: https://github.com/mapserver/mapserver
Language: C
Files changed: mapogcfilter.c, mapogcfiltercommon.c
Commit date: 2017-01-16 11:42:59 -0400
Commit message: security fix (patch by EvenR)

Diff: diff --git a/mapogcfilter.c b/mapogcfilter.c
index 03c26d67b..7da559a15 100644
--- a/mapogcfilter.c
+++ b/mapogcfilter.c
@@ -3002,10 +3002,12 @@ char *FLTGetIsLikeComparisonExpression(FilterEncodingNode *psFilterNode)
   szBuffer[strlen(szBuffer)] = '\0';
 
 
   pszValue = psFilterNode->psRightNode->pszValue;
   nLength = strlen(pszValue);
+  if( 1 + 2 * nLength + 1 + 1 >= sizeof(szTmp) )
+      return NULL;
 
   iTmp =0;
   if (nLength > 0 && pszValue[0] != pszWild[0] &&
       pszValue[0] != pszSingle[0] &&
       pszValue[0] != pszEscape[0]) {
diff --git a/mapogcfiltercommon.c b/mapogcfiltercommon.c
index 74bcb5f0a..600ab0924 100644
--- a/mapogcfiltercommon.c
+++ b/mapogcfiltercommon.c
@@ -86,10 +86,12 @@ char *FLTGetIsLikeComparisonCommonExpression(FilterEncodingNode *psFilterNode)
   strlcat(szBuffer, szTmp, bufferSize);
   szBuffer[strlen(szBuffer)] = '\0';
 
   pszValue = psFilterNode->psRightNode->pszValue;
   nLength = strlen(pszValue);
+  if( 1 + 2 * nLength + 1 + 1 >= sizeof(szTmp) )
+      return NULL;
 
   iTmp =0;
   if (nLength > 0 && pszValue[0] != pszWild[0] && pszValue[0] != pszSingle[0] && pszValue[0] != pszEscape[0]) {
     szTmp[iTmp]= '^';
     iTmp++;

Fixed code:   if( 1 + 2 * nLength + 1 + 1 >= sizeof(szTmp) )
      return NULL;
  if( 1 + 2 * nLength + 1 + 1 >= sizeof(szTmp) )
      return NULL;
CVE-2021-39132: Deserialization of Untrusted Data (CWE-502)
value: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.8
Published: 2021-08-30T20:15Z
Repository: https://github.com/rundeck/rundeck
Language: Unknown
Commit date: 2021-08-13 09:21:52 -0700
Commit message: Merge pull request from GHSA-q4rf-3fhx-88pf

fix: plugin yaml loader should only deserialize the PluginMeta type
CVE-2021-39133: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.8
Published: 2021-08-30T20:15Z
Repository: https://github.com/rundeck/rundeck
Language: Unknown
Commit date: 2021-08-13 09:26:03 -0700
Commit message: Merge pull request from GHSA-3jmw-c69h-426c

Add CSRF protection to plugin upload/install endpoints
CVE-2021-41111: Authorization Bypass Through User-Controlled Key (CWE-639)
value: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 5.4
Published: 2022-02-28T20:15Z
Repository: https://github.com/rundeck/rundeck
Language: Unknown
Commit date: 2021-10-01 10:55:24 -0700
Commit message: Merge pull request from GHSA-mfqj-f22m-gv8j

Fix IDOR webhook get does not correctly authorize project
Diff: diff --cc grails-webhooks/grails-app/controllers/webhooks/WebhookController.groovy
index c0f3171dd2,cc87931632..afbc987a0e
--- a/grails-webhooks/grails-app/controllers/webhooks/WebhookController.groovy
+++ b/grails-webhooks/grails-app/controllers/webhooks/WebhookController.groovy
@@@ -82,15 -78,19 +82,19 @@@ class WebhookController 
              return apiService.renderErrorFormat(response, [status: HttpServletResponse.SC_BAD_REQUEST,
                                                             code: 'api.error.parameter.required', args: ['id']])
  
          }
          UserAndRolesAuthContext authContext = rundeckAuthContextProvider.getAuthContextForSubjectAndProject(session.subject,params.project)
 -        if (!authorized(authContext, params.project, RESOURCE_TYPE_WEBHOOK, ACTION_READ)) {
 +        if (!authorized(authContext, params.project, AuthConstants.ACTION_READ)) {
              sendJsonError("You do not have access to this resource")
              return
          }
-         render webhookService.getWebhookWithAuth(params.id) as JSON
+         def webhook = webhookService.getWebhookForProjectWithAuth(params.id, params.project)
+         if(!webhook){
+             return sendJsonError("Webhook not found", HttpServletResponse.SC_NOT_FOUND)
+         }
+         render webhook as JSON
      }
  
      def list() {
          if(!params.project){
              return apiService.renderErrorFormat(response, [status: HttpServletResponse.SC_BAD_REQUEST,
CVE-2022-29186: Use of Hard-coded Credentials (CWE-798)
value: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized_keys files on remote host, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances of PagerDuty® Process Automation On Prem (formerly Rundeck) version 4.0 and earlier, not Debian, RPM or .WAR. Additionally, the id_rsa.pub file would have to be copied from the Docker image filesystem contents without overwriting it and used to configure SSH access on a host. A patch on Rundeck's `main` branch has removed the pre-generated SSH key pair, but it does not remove exposed keys that have been configured. To patch, users must run a script on hosts in their environment to search for exposed keys and rotate them. Two workarounds are available: Do not use any pre-existing public key file from the rundeck docker images to allow SSH access by adding it to authorized_keys files and, if you have copied the public key file included in the docker image, remove it from any authorized_keys files.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 9.8
Published: 2022-05-20T21:15Z
Repository: https://github.com/rundeck/rundeck
Language: Unknown
Commit date: 2022-05-11 10:01:07 -0700
Commit message: Merge pull request from GHSA-qxjx-xr2m-hgqx

Remove ssh-keygen from dockerfile
CVE-2022-36058: Improper Input Validation (CWE-20)
value: Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks (historical or actual) could encounter a `MultiESDTNFTTransfer` transaction like this: `MultiESDTNFTTransfer` with a missing function name. Basic functionality like p2p messaging, storage, API requests and such are unaffected. Version 1.3.34 contains a fix for this issue. There are no known workarounds.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2022-09-06T20:15Z
Repository: https://github.com/ElrondNetwork/elrond-go
Language: Unknown
Commit date: 2022-07-06 22:17:27 +0300
Commit message: Merge pull request from GHSA-qf7j-25g9-r63f

Extra check in vm-common
CVE-2022-46173: Incorrect Resource Transfer Between Spheres (CWE-669)
value: Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The problem was a bad correlation between the transaction caches and the processing component. If the above-mentioned transaction was sent with more gas than required, the smart contract result (SCR transaction) that should have returned the leftover gas, would have been wrongly added to a cache that the processing unit did not consider. The node stopped notarizing metachain blocks. The fix was actually to extend the SCR transaction search in all other caches if it wasn't found in the correct (expected) sharded-cache. There are no known workarounds at this time. This issue has been patched in version 1.3.50.

CWE description: The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
CVSS v3 base score: 6.5
Published: 2022-12-28T07:15Z
Repository: https://github.com/ElrondNetwork/elrond-go
Language: Unknown
Commit date: 2022-11-21 01:58:00 +0200
Commit message: Merge pull request #4718 from ElrondNetwork/test-scr-processor-lookup

Improve SCR lookup in smartcontract preprocessor
CVE-2015-10012: Generation of Error Message Containing Sensitive Information (CWE-209)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html.twig. The manipulation leads to information exposure through error message. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is abe4993390ba9bd7821ab12678270556645f94c8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217268. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 7.5
Published: 2023-01-03T09:15Z
Repository: https://github.com/sumocoders/FrameworkUserBundle
Language: Other
Files changed: Resources/views/Security/login.html.twig
Commit date: 2015-06-22 16:32:19 +0200
Commit message: Make sure we don't get a doctrine error message.

The old exception message gave us a lot of info about our application.
This could help a user find out we're running Symfony and find possible
exploits. This commit will hide the message behind a translated version
of the message of the exception.

Diff: diff --git a/Resources/views/Security/login.html.twig b/Resources/views/Security/login.html.twig
index 25b02d1..cad2535 100644
--- a/Resources/views/Security/login.html.twig
+++ b/Resources/views/Security/login.html.twig
@@ -11,11 +11,11 @@
     <form action="{{ path("fos_user_security_check") }}" method="post">
         <input type="hidden" name="_csrf_token" value="{{ csrf_token }}" />
 
         {% if error %}
             <div class="alert alert-info">
-                {{ error|trans }}
+                {{ error.messageKey|trans(error.messageData, 'security') }}
             </div>
         {% endif %}
 
         <fieldset>
             <div class="form-group">

Vulnerable code:                 {{ error|trans }}
Fixed code:                 {{ error.messageKey|trans(error.messageData, 'security') }}
CVE-2022-4607: Improper Restriction of XML External Entity Reference (CWE-611)
value: A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch is 246f4e2a97ad81491c00a7ed72ce5e7c7f75050a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216215.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2022-12-18T22:15Z
Repository: https://github.com/3dcitydb/web-feature-service
Language: Unknown
Commit date: 2022-06-21 07:08:09 +0200
Commit message: Merge pull request #12 from 3dcitydb/hotfix-prevent-xxe-vulnerabilities

Prevent XXE vulnerabilities
CVE-2020-11054: Incorrect Provision of Specified Functionality (CWE-684)
value: In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended), this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are available, but no further releases are planned.
CWE description: The code does not function according to its published specifications, potentially leading to incorrect usage.
CVSS v3 base score: 3.5
Published: 2020-05-07T21:15Z
Repository: https://github.com/qutebrowser/qutebrowser
Language: Other
Files changed: doc/changelog.asciidoc
Commit date: 2020-05-02 19:03:20 +0200
Commit message: Update changelog

Diff: diff --git a/doc/changelog.asciidoc b/doc/changelog.asciidoc
index 208d369176..3d39eec858 100644
--- a/doc/changelog.asciidoc
+++ b/doc/changelog.asciidoc
@@ -43,11 +43,20 @@ Fixed
   schemes like `qute://`.
 
 v1.11.1 (unreleased)
 --------------------
 
-No changes yet.
+Security
+~~~~~~~~
+
+- After a certificate error was overridden by the user, qutebrowser displays
+  the URL as yellow (`colors.statusbar.url.warn.fg`). However, when the
+  affected website was subsequently loaded again, the URL was mistakenly
+  displayed as green (`colors.statusbar.url.success_https`). While the user
+  already has seen a certificate error prompt at this point (or set
+  `content.ssl_strict` to `false` which is not recommended), this could still
+  provide a false sense of security. This is now fixed.
 
 v1.11.0 (2020-04-27)
 --------------------
 
 Added

Vulnerable code: No changes yet.
Fixed code: Security
~~~~~~~~

- After a certificate error was overridden by the user, qutebrowser displays
  the URL as yellow (`colors.statusbar.url.warn.fg`). However, when the
  affected website was subsequently loaded again, the URL was mistakenly
  displayed as green (`colors.statusbar.url.success_https`). While the user
  already has seen a certificate error prompt at this point (or set
  `content.ssl_strict` to `false` which is not recommended), this could still
  provide a false sense of security. This is now fixed.
CVE-2021-4291: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216916.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T23:15Z
Repository: https://github.com/openmrs/openmrs-module-adminui
Language: Other
Files changed: omod/src/main/webapp/pages/metadata/locations/location.gsp
Commit date: 2021-06-16 10:07:06 -0400
Commit message: RA-1424: escapeJs vulnerable to XSS. (#61)


Diff: diff --git a/omod/src/main/webapp/pages/metadata/locations/location.gsp b/omod/src/main/webapp/pages/metadata/locations/location.gsp
index 6eb51f7..27e50b5 100644
--- a/omod/src/main/webapp/pages/metadata/locations/location.gsp
+++ b/omod/src/main/webapp/pages/metadata/locations/location.gsp
@@ -7,11 +7,11 @@
 
     def createLocation = (location.locationId == null ? true : false);
 
     def parentLocationOptions = []
     existingLocations.each {
-        parentLocationOptions.push([ label: ui.escapeJs(ui.format(it)), value: it.id ])
+        parentLocationOptions.push([ label: ui.encodeJavaScript(ui.format(it)), value: it.id ])
     }
 %>
 
 <script type="text/javascript">
     var breadcrumbs = [

Vulnerable code:         parentLocationOptions.push([ label: ui.escapeJs(ui.format(it)), value: it.id ])
Fixed code:         parentLocationOptions.push([ label: ui.encodeJavaScript(ui.format(it)), value: it.id ])
CVE-2021-4292: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/metadata/privileges/privilege.gsp of the component Manage Privilege Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 4f8565425b7c74128dec9ca46dfbb9a3c1c24911. It is recommended to upgrade the affected component. The identifier VDB-216917 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T23:15Z
Repository: https://github.com/openmrs/openmrs-module-adminui
Language: Unknown
Commit date: 2021-04-01 17:53:58 -0500
Commit message: Merge pull request #58 from jmmacdo4/master

EMPT-74. Fix XSS vulnerability on the manage privilege page
CVE-2019-25159: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in mpedraza2020 Intranet del Monterroso up to 4.50.0. It has been classified as critical. This affects an unknown part of the file config/cargos.php. The manipulation of the argument dni_profe leads to sql injection. Upgrading to version 4.51.0 is able to address this issue. The identifier of the patch is 678190bee1dfd64b54a2b0e88abfd009e78adce8. It is recommended to upgrade the affected component. The identifier VDB-252717 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2024-02-04T06:15Z
Repository: https://github.com/mpedraza2020/IESMONTEROSOINTRANET
Language: PHP
Files changed: config/cargos.php
Commit date: 2019-12-18 17:07:29 +0100
Commit message: SQL Injection in $_GET['dni_profe'] - "config/cargos.php"

Filters for SQL Injection in $_GET['dni_profe']
Diff: diff --git a/config/cargos.php b/config/cargos.php
index 01b6dfc8..0a85cc25 100755
--- a/config/cargos.php
+++ b/config/cargos.php
@@ -11,11 +11,12 @@ include ("../menu.php");
 	  <h2>Administración <small> Perfiles de Profesores</small></h2>
 	</div>
 
 	<?php
 	if ($_GET['borrar']=='1') {
-		mysqli_query($db_con, "delete from departamentos where dni = '".$_GET['dni_profe']."'");
+		$dni_profe = preg_replace('([^A-Za-z0-9])', '', $_GET['dni_profe']);
+		mysqli_query($db_con, "delete from departamentos where dni = '".$dni_profe."'");
 		echo '<div class="alert alert-success">
 	            <button type="button" class="close" data-dismiss="alert">&times;</button>
 	            El profesor ha sido borrado de la base de datos..
 	          </div>';
 	}

Vulnerable code: 		mysqli_query($db_con, "delete from departamentos where dni = '".$_GET['dni_profe']."'");
Fixed code: 		$dni_profe = preg_replace('([^A-Za-z0-9])', '', $_GET['dni_profe']);
		mysqli_query($db_con, "delete from departamentos where dni = '".$dni_profe."'");
CVE-2019-14806: Insufficient Entropy (CWE-331)
value: Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
CWE description: The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
CVSS v3 base score: 7.5
Published: 2019-08-09T15:15Z
Repository: https://github.com/pallets/werkzeug
Language: Python
Files changed: CHANGES.rst, src/werkzeug/debug/__init__.py
Commit date: 2019-05-14 13:43:22 -0700
Commit message: unique debugger pin in Docker containers

Diff: diff --git a/CHANGES.rst b/CHANGES.rst
index 87033da6..70dbab9d 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -18,10 +18,12 @@ Unreleased
     float values. (:issue:`1511`)
 -   Update :class:`~middleware.lint.LintMiddleware` to work on Python 3.
     (:issue:`1510`)
 -   The debugger detects cycles in chained exceptions and does not time
     out in that case. (:issue:`1536`)
+-   When running the development server in Docker, the debugger security
+    pin is now unique per container.
 
 
 Version 0.15.2
 --------------
 
diff --git a/src/werkzeug/debug/__init__.py b/src/werkzeug/debug/__init__.py
index c5e4d2d5..9195c79a 100644
--- a/src/werkzeug/debug/__init__.py
+++ b/src/werkzeug/debug/__init__.py
@@ -65,10 +65,23 @@ def get_machine_id():
     rv = _machine_id
     if rv is not None:
         return rv
 
     def _generate():
+        # docker containers share the same machine id, get the
+        # container id instead
+        try:
+            with open("/proc/self/cgroup") as f:
+                value = f.readline()
+        except IOError:
+            pass
+        else:
+            value = value.strip().partition("/docker/")[2]
+
+            if value:
+                return value
+
         # Potential sources of secret information on linux.  The machine-id
         # is stable across boots, the boot id is not
         for filename in "/etc/machine-id", "/proc/sys/kernel/random/boot_id":
             try:
                 with open(filename, "rb") as f:

Fixed code: -   When running the development server in Docker, the debugger security
    pin is now unique per container.
        # docker containers share the same machine id, get the
        # container id instead
        try:
            with open("/proc/self/cgroup") as f:
                value = f.readline()
        except IOError:
            pass
        else:
            value = value.strip().partition("/docker/")[2]

            if value:
                return value
CVE-2022-29361: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (CWE-444)
value: Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project
CWE description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
CVSS v3 base score: 9.8
Published: 2022-05-25T01:15Z
Repository: https://github.com/pallets/werkzeug
Language: Unknown
Commit date: 2022-02-17 16:24:11 -0800
Commit message: Merge branch '2.0.x'
CVE-2023-23934: Improper Input Validation (CWE-20)
value: Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 3.5
Published: 2023-02-14T20:15Z
Repository: https://github.com/pallets/werkzeug
Language: Unknown
Commit date: 2023-02-14 08:30:17 -0800
Commit message: Merge pull request from GHSA-px8h-6qxv-m22q

don't strip leading `=` when parsing cookie
CVE-2023-25577: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2023-02-14T20:15Z
Repository: https://github.com/pallets/werkzeug
Language: Unknown
Commit date: 2023-02-14 09:08:57 -0800
Commit message: Merge pull request from GHSA-xg9f-g7g7-2323

limit the maximum number of multipart form parts
CVE-2023-46136: Out-of-bounds Write (CWE-787)
value: Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-10-25T18:17Z
Repository: https://github.com/pallets/werkzeug
Language: Unknown
Commit date: 2023-10-24 22:24:22 +0100
Commit message: Merge 3.0.x (#2801)
CVE-2024-34069: Insufficient Information (NVD-CWE-noinfo)
value: Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-06T15:15Z
Repository: https://github.com/pallets/werkzeug
Language: Unknown
Commit date: 2024-05-05 16:00:13 -0700
Commit message: Merge pull request from GHSA-2g68-c3qc-8985

restrict debugger trusted hosts
CVE-2022-0336: Incorrect Default Permissions (CWE-276)
value: The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 8.8
Published: 2022-08-29T15:15Z
Repository: https://github.com/samba-team/samba
Language: Other
Files changed: selftest/knownfail.d/ldap_spn, source4/dsdb/samdb/ldb_modules/samldb.c
Commit date: 2022-01-31 15:27:37 +0000
Commit message: CVE-2022-0336: s4/dsdb/samldb: Don't return early when an SPN is re-added to an object

If an added SPN already exists on an object, we still want to check the
rest of the element values for conflicts.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14950

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Diff: diff --git a/selftest/knownfail.d/ldap_spn b/selftest/knownfail.d/ldap_spn
index 16dafa91b6..63f9fe02ef 100644
--- a/selftest/knownfail.d/ldap_spn
+++ b/selftest/knownfail.d/ldap_spn
@@ -1,2 +1 @@
 samba.tests.ldap_spn.+LdapSpnTest.test_spn_dodgy_spns
-samba.tests.ldap_spn.+LdapSpnSambaOnlyTest.test_spn_add_a_conflict_along_with_a_re_added_SPN
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index db3883eb52..24971d521a 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -4004,12 +4004,11 @@ static int samldb_spn_uniqueness_check(struct samldb_ctx *ac,
 						 tmp_ctx,
 						 spn,
 						 ac->msg->dn);
 		if (ret == LDB_ERR_COMPARE_TRUE) {
 			DBG_INFO("SPN %s re-added to the same object\n", spn);
-			talloc_free(tmp_ctx);
-			return LDB_SUCCESS;
+			continue;
 		}
 		if (ret != LDB_SUCCESS) {
 			DBG_ERR("SPN %s failed direct uniqueness check\n", spn);
 			talloc_free(tmp_ctx);
 			return ret;

Vulnerable code: samba.tests.ldap_spn.+LdapSpnSambaOnlyTest.test_spn_add_a_conflict_along_with_a_re_added_SPN
			talloc_free(tmp_ctx);
			return LDB_SUCCESS;
Fixed code: 			continue;
CVE-2022-23626: Unchecked Return Value (CWE-252)
value: m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CWE description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CVSS v3 base score: 8.8
Published: 2022-02-08T22:15Z
Repository: https://github.com/m1k1o/blog
Language: PHP
Files changed: app/image.class.php
Commit date: 2022-01-06 17:23:43 +0100
Commit message: check image create errors.

Diff: diff --git a/app/image.class.php b/app/image.class.php
index 6810a42..2297ccd 100644
--- a/app/image.class.php
+++ b/app/image.class.php
@@ -108,19 +108,20 @@ class Image
 			default:
 				return false;
 		}
 
 		$old_image = $imgcreatefrom($source_path);
+		if ($old_image === false) return false;
+
 		$new_image = imagecreatetruecolor($new_w, $new_h);
 		imagecopyresampled($new_image, $old_image, 0, 0, 0, 0, $new_w, $new_h, $source_w, $source_h);
 
 		$new_image = self::fix_orientation($source_path, $new_image);
 		$old_image = self::fix_orientation($source_path, $old_image);
 
-		$imgt($new_image, $thumb_path);
-		$imgt($old_image, $source_path);
-		return true;
+		return $imgt($new_image, $thumb_path)
+			&& $imgt($old_image, $source_path);
 	}
 
 	public static function upload(){
 		if(!$_FILES){
 			throw new Exception("No file.");

Vulnerable code: 		$imgt($new_image, $thumb_path);
		$imgt($old_image, $source_path);
		return true;
Fixed code: 		if ($old_image === false) return false;

		return $imgt($new_image, $thumb_path)
			&& $imgt($old_image, $source_path);
CVE-2021-21292: Unquoted Search Path or Element (CWE-428)
value: Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on the host machine. If Java path includes a space, then attacker can lift their privilege to the same as Traccar service (system). This is fixed in version 4.12.
CWE description: The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
CVSS v3 base score: 6.3
Published: 2021-02-02T20:15Z
Repository: https://github.com/traccar/traccar
Language: Java
Files changed: src/main/java/org/traccar/WindowsService.java
Commit date: 2021-01-01 14:50:50 -0800
Commit message: Quote binary path

Diff: diff --git a/src/main/java/org/traccar/WindowsService.java b/src/main/java/org/traccar/WindowsService.java
index 831cd3ebc..f233337a7 100644
--- a/src/main/java/org/traccar/WindowsService.java
+++ b/src/main/java/org/traccar/WindowsService.java
@@ -1,7 +1,7 @@
 /*
- * Copyright 2018 Anton Tananaev (anton@traccar.org)
+ * Copyright 2018 - 2020 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
@@ -48,11 +48,11 @@ public abstract class WindowsService {
     public void install(
             String displayName, String description, String[] dependencies,
             String account, String password, String config) throws URISyntaxException {
 
         String javaHome = System.getProperty("java.home");
-        String javaBinary = javaHome + "\\bin\\java.exe";
+        String javaBinary = "\"" + javaHome + "\\bin\\java.exe\"";
 
         File jar = new File(WindowsService.class.getProtectionDomain().getCodeSource().getLocation().toURI());
         String command = javaBinary
                 + " -Duser.dir=\"" + jar.getParentFile().getAbsolutePath() + "\""
                 + " -jar \"" + jar.getAbsolutePath() + "\""

Vulnerable code:  * Copyright 2018 Anton Tananaev (anton@traccar.org)
        String javaBinary = javaHome + "\\bin\\java.exe";
Fixed code:  * Copyright 2018 - 2020 Anton Tananaev (anton@traccar.org)
        String javaBinary = "\"" + javaHome + "\\bin\\java.exe\"";
CVE-2024-24809: Insufficient Information (NVD-CWE-noinfo)
value: Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this vulnerability to upload files with the prefix `device.` under any folder. Attackers can use this vulnerability for phishing, cross-site scripting attacks, and potentially execute arbitrary commands on the server. Version 6.0 contains a patch for the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-10T15:16Z
Repository: https://github.com/traccar/traccar
Language: Java
Files changed: src/main/java/org/traccar/api/resource/DeviceResource.java
Commit date: 2024-04-04 08:03:16 -0700
Commit message: Remove extra dot

Diff: diff --git a/src/main/java/org/traccar/api/resource/DeviceResource.java b/src/main/java/org/traccar/api/resource/DeviceResource.java
index d7236fe2ac..2edb0d16d5 100644
--- a/src/main/java/org/traccar/api/resource/DeviceResource.java
+++ b/src/main/java/org/traccar/api/resource/DeviceResource.java
@@ -173,19 +173,19 @@ public class DeviceResource extends BaseObjectResource<Device> {
     }
 
     private String imageExtension(String type) {
         switch (type) {
             case "image/jpeg":
-                return ".jpg";
+                return "jpg";
             case "image/png":
-                return ".png";
+                return "png";
             case "image/gif":
-                return ".gif";
+                return "gif";
             case "image/webp":
-                return ".webp";
+                return "webp";
             case "image/svg+xml":
-                return ".svg";
+                return "svg";
             default:
                 throw new IllegalArgumentException("Unsupported image type");
         }
     }
 

Vulnerable code:                 return ".jpg";
                return ".png";
                return ".gif";
                return ".webp";
                return ".svg";
Fixed code:                 return "jpg";
                return "png";
                return "gif";
                return "webp";
                return "svg";
CVE-2024-31214: Insufficient Information (NVD-CWE-noinfo)
value: Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is stored, full control over the file extension, and partial control over the file name. While it's not  for an attacker to overwrite an existing file, an attacker can create new files with certain names and attacker-controlled extensions anywhere on the file system. This can potentially lead to remote code execution, XSS, DOS, etc. The default install of Traccar makes this vulnerability more severe. Self-registration is enabled by default, allowing anyone to create an account to exploit this vulnerability. Traccar also runs by default with root/system privileges, allowing files to be placed anywhere on the file system. Version 6.0 contains a fix for the issue. One may also turn off self-registration by default, as that would make most vulnerabilities in the application much harder to exploit by default and reduce the severity considerably.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-10T18:15Z
Repository: https://github.com/traccar/traccar
Language: Java
Files changed: src/main/java/org/traccar/model/Device.java
Commit date: 2024-04-04 07:41:50 -0700
Commit message: Update device id check

Diff: diff --git a/src/main/java/org/traccar/model/Device.java b/src/main/java/org/traccar/model/Device.java
index a3088a613d..c2da9be79f 100644
--- a/src/main/java/org/traccar/model/Device.java
+++ b/src/main/java/org/traccar/model/Device.java
@@ -51,11 +51,11 @@ public class Device extends GroupedModel implements Disableable, Schedulable {
     public String getUniqueId() {
         return uniqueId;
     }
 
     public void setUniqueId(String uniqueId) {
-        if (uniqueId.contains("../") || uniqueId.contains("..\\")) {
+        if (uniqueId.contains("..")) {
             throw new IllegalArgumentException("Invalid unique id");
         }
         this.uniqueId = uniqueId.trim();
     }
 

Vulnerable code:         if (uniqueId.contains("../") || uniqueId.contains("..\\")) {
Fixed code:         if (uniqueId.contains("..")) {
CVE-2013-10005: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2022-12-27T22:15Z
Repository: https://github.com/btcsuite/go-socks
Language: Go
Files changed: conn.go
Commit date: 2013-08-07 20:04:56 -0400
Commit message: fix potential infinite loops in both LocalAddr and RemoteAddr

Diff: diff --git a/conn.go b/conn.go
index 10f8f83..c7c6e45 100644
--- a/conn.go
+++ b/conn.go
@@ -29,18 +29,18 @@ func (c *proxiedConn) Close() error {
 
 func (c *proxiedConn) LocalAddr() net.Addr {
 	if c.boundAddr != nil {
 		return c.boundAddr
 	}
-	return c.LocalAddr()
+	return c.conn.LocalAddr()
 }
 
 func (c *proxiedConn) RemoteAddr() net.Addr {
 	if c.remoteAddr != nil {
 		return c.remoteAddr
 	}
-	return c.RemoteAddr()
+	return c.conn.RemoteAddr()
 }
 
 func (c *proxiedConn) SetDeadline(t time.Time) error {
 	return c.conn.SetDeadline(t)
 }

Vulnerable code: 	return c.LocalAddr()
	return c.RemoteAddr()
Fixed code: 	return c.conn.LocalAddr()
	return c.conn.RemoteAddr()
CVE-2016-3693: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 8.1
Published: 2016-05-20T14:59Z
Repository: https://github.com/theforeman/foreman
Language: Other
Files changed: Gemfile
Commit date: 2016-04-18 15:42:50 +0100
Commit message: Fixes #14635 - bump safemode version to fix the unwanted inspect issue

Diff: diff --git a/Gemfile b/Gemfile
index 5ac752ec1..0adfd6e6c 100644
--- a/Gemfile
+++ b/Gemfile
@@ -17,11 +17,11 @@ gem 'oauth', '~> 0.4'
 gem 'deep_cloneable', '~> 2.0'
 gem 'foreigner', '~> 1.4'
 gem 'validates_lengths_from_database', '~> 0.5'
 gem 'friendly_id', '~> 5.0'
 gem 'secure_headers', '~> 1.3'
-gem 'safemode', '~> 1.2'
+gem 'safemode', '~> 1.2', '>= 1.2.4'
 gem 'fast_gettext', '>= 0.8', '< 2.0'
 gem 'gettext_i18n_rails', '~> 1.0'
 gem 'rails-i18n', '~> 4.0.0'
 gem 'turbolinks', '~> 2.5'
 gem 'logging', '>= 1.8.0', '< 3.0.0'

Vulnerable code: gem 'safemode', '~> 1.2'
Fixed code: gem 'safemode', '~> 1.2', '>= 1.2.4'