Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-27579: Incorrect Comparison (CWE-697)
value: TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1.

CWE description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CVSS v3 base score: 7.5
Published: 2023-03-25T00:15Z
Repository: https://github.com/tensorflow/tensorflow
Language: C++
Files changed: tensorflow/lite/kernels/conv.cc
Commit date: 2023-01-19 14:34:35 -0800
Commit message: Check filter_input_channel > 0 in conv kernel.

PiperOrigin-RevId: 503266928

Diff: diff --git a/tensorflow/lite/kernels/conv.cc b/tensorflow/lite/kernels/conv.cc
index f2116695de7f3..8961d0d7d63b4 100644
--- a/tensorflow/lite/kernels/conv.cc
+++ b/tensorflow/lite/kernels/conv.cc
@@ -345,10 +345,11 @@ TfLiteStatus Prepare(KernelType kernel_type, TfLiteContext* context,
   // Check input channels matching filter
   // Filter input channel can be a factor of channels of input (grouped conv)
   // or equals (normal conv).
   auto input_channel = input->dims->data[3];
   auto filter_input_channel = filter->dims->data[3];
+  TF_LITE_ENSURE(context, filter_input_channel > 0);
   TF_LITE_ENSURE_EQ(context, input_channel % filter_input_channel, 0);
   data->groups = input_channel / filter_input_channel;
 
   // Check types. (We assume that UINT8 refers to quantized tensors)
   TfLiteType input_type = input->type;

Fixed code:   TF_LITE_ENSURE(context, filter_input_channel > 0);
CVE-2020-19860: Out-of-bounds Read (CWE-125)
value: When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An attacker can leak information on the heap by constructing a zone file payload.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2022-01-21T14:15Z
Repository: https://github.com/NLnetLabs/ldns
Language: Other
Files changed: Changelog, rr.c
Commit date: 2019-09-24 16:50:27 +0200
Commit message: * bugfix #70: heap Out-of-bound Read vulnerability in
  rr_frm_str_internal reported by pokerfacett.

Diff: diff --git a/Changelog b/Changelog
index 5972c261..8d8a1a3f 100644
--- a/Changelog
+++ b/Changelog
@@ -1,5 +1,9 @@
+...
+	* bugfix #70: heap Out-of-bound Read vulnerability in
+	  rr_frm_str_internal reported by pokerfacett.
+
 1.7.1	2019-07-26
 	* bugfix: Manage verification paths for OpenSSL >= 1.1.0
 	  Thanks Marco Davids
 	* bugfix #4106: find the SDK on MacOS X <= 10.6
 	  Thanks Bill Cole
diff --git a/rr.c b/rr.c
index 6642aca7..adf67ae4 100644
--- a/rr.c
+++ b/rr.c
@@ -363,19 +363,22 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 				ldns_rr_descriptor_field_type(
 				desc, r_cnt)) &&
 				ldns_buffer_remaining(rd_buf) > 0){
 
 			/* skip spaces */
-			while (*(ldns_buffer_current(rd_buf)) == ' ') {
+			while (sldns_buffer_remaining(strbuf) > 0 &&
+				*(ldns_buffer_current(rd_buf)) == ' ') {
 				ldns_buffer_skip(rd_buf, 1);
 			}
 
-			if (*(ldns_buffer_current(rd_buf)) == '\"') {
+			if (sldns_buffer_remaining(strbuf) > 0 &&
+				*(ldns_buffer_current(rd_buf)) == '\"') {
 				delimiters = "\"\0";
 				ldns_buffer_skip(rd_buf, 1);
 				quoted = true;
-			} else if (ldns_rr_descriptor_field_type(desc, r_cnt)
+			}
+			if (!quoted && ldns_rr_descriptor_field_type(desc, r_cnt)
 					== LDNS_RDF_TYPE_LONG_STR) {
 
 				status = LDNS_STATUS_SYNTAX_RDATA_ERR;
 				goto error;
 			}

Vulnerable code: 			while (*(ldns_buffer_current(rd_buf)) == ' ') {
			if (*(ldns_buffer_current(rd_buf)) == '\"') {
			} else if (ldns_rr_descriptor_field_type(desc, r_cnt)
Fixed code: ...
	* bugfix #70: heap Out-of-bound Read vulnerability in
	  rr_frm_str_internal reported by pokerfacett.

			while (sldns_buffer_remaining(strbuf) > 0 &&
				*(ldns_buffer_current(rd_buf)) == ' ') {
			if (sldns_buffer_remaining(strbuf) > 0 &&
				*(ldns_buffer_current(rd_buf)) == '\"') {
			}
			if (!quoted && ldns_rr_descriptor_field_type(desc, r_cnt)
CVE-2023-39346: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file. The problem has been patched in commit 20dba06bd1a3cf260612d4f21547c25002121cd5. There are no known workarounds.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-08-04T21:15Z
Repository: https://github.com/bjrjk/LinuxASMCallGraph
Language: PHP
Files changed: web/index.php
Commit date: 2022-02-08 16:29:04 +0800
Commit message: Fixed Vulnerability

Fixed Vulnerability #6 and #8.

Diff: diff --git a/web/index.php b/web/index.php
index 198c20f..48006ea 100644
--- a/web/index.php
+++ b/web/index.php
@@ -30,16 +30,19 @@ if (isset($_FILES["file"])) {
         if($retCode != 0){
             die("Script execution error!");
         }
         header("Location:  tmp/$fileMD5.png");
     } else {
-        $command = "unzip -l \"$fullName.zip\" | grep php 2>&1";
+        $command = "zipinfo \"$fullName.zip\" | grep -P l[rwx-]{9} 2>&1";
         exec($command,$message,$retCode);
         if(count($message)){
-            die("Don't try to do bad things!");
+            die("Don't try to do bad! You tricky Linux hacker boy!");
+        }
+        $command = "unzip \"$fullName.zip\" -d \"$fullName\" | grep -P \".php|.htaccess\" 2>&1";
+		if(count($message)){
+            die("Don't try to do bad! You tricky web hacker boy!");
         }
-        $command = "unzip \"$fullName.zip\" -d \"$fullName\" 2>&1";
         exec($command,$message,$retCode);
         if($retCode != 0){
             die("unzip error!");
         }
         if (file_exists($fullName . '/main.cpp')) $extension = 'cpp';

Vulnerable code:         $command = "unzip -l \"$fullName.zip\" | grep php 2>&1";
            die("Don't try to do bad things!");
        $command = "unzip \"$fullName.zip\" -d \"$fullName\" 2>&1";
Fixed code:         $command = "zipinfo \"$fullName.zip\" | grep -P l[rwx-]{9} 2>&1";
            die("Don't try to do bad! You tricky Linux hacker boy!");
        }
        $command = "unzip \"$fullName.zip\" -d \"$fullName\" | grep -P \".php|.htaccess\" 2>&1";
		if(count($message)){
            die("Don't try to do bad! You tricky web hacker boy!");
CVE-2020-15235: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to everyone except admins. All versions after commit f3dc89b9f6ab1544a289b3efc06699b13d63e0bd(3/10/20) are patched.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2020-10-05T16:15Z
Repository: https://github.com/ractf/core
Language: Python
Files changed: src/config/config.py, src/config/views.py
Commit date: 2020-10-03 20:11:20 +0100
Commit message: patch unauthenticated users being able to read sensitive config fields by viewing them individually instead of listing them (#37)


Diff: diff --git a/src/config/config.py b/src/config/config.py
index be42c79..b7a324e 100644
--- a/src/config/config.py
+++ b/src/config/config.py
@@ -62,10 +62,14 @@ def get_all_non_sensitive():
     for field in sensitive:
         del config[field]
     return config
 
 
+def is_sensitive(key):
+    return key in backend.get('sensitive_fields')
+
+
 def set_bulk(values: dict):
     for key, value in values.items():
         set(key, value)
 
 
diff --git a/src/config/views.py b/src/config/views.py
index e62731f..3b1b2ea 100644
--- a/src/config/views.py
+++ b/src/config/views.py
@@ -1,6 +1,6 @@
-from rest_framework.status import HTTP_400_BAD_REQUEST
+from rest_framework.status import HTTP_400_BAD_REQUEST, HTTP_403_FORBIDDEN
 from rest_framework.views import APIView
 
 from backend.response import FormattedResponse
 from config import config
 from backend.permissions import AdminOrAnonymousReadOnly
@@ -10,14 +10,16 @@ class ConfigView(APIView):
     throttle_scope = "config"
     permission_classes = (AdminOrAnonymousReadOnly,)
 
     def get(self, request, name=None):
         if name is None:
-            if request.user.is_staff:
+            if request.user.is_superuser:
                 return FormattedResponse(config.get_all())
             return FormattedResponse(config.get_all_non_sensitive())
-        return FormattedResponse(config.get(name))
+        if not config.is_sensitive(name) or request.is_superuser:
+            return FormattedResponse(config.get(name))
+        return FormattedResponse(status=HTTP_403_FORBIDDEN)
 
     def post(self, request, name):
         if "value" not in request.data:
             return FormattedResponse(status=HTTP_400_BAD_REQUEST)
         config.set(name, request.data.get("value"))

Vulnerable code: from rest_framework.status import HTTP_400_BAD_REQUEST
            if request.user.is_staff:
        return FormattedResponse(config.get(name))
Fixed code: def is_sensitive(key):
    return key in backend.get('sensitive_fields')


from rest_framework.status import HTTP_400_BAD_REQUEST, HTTP_403_FORBIDDEN
            if request.user.is_superuser:
        if not config.is_sensitive(name) or request.is_superuser:
            return FormattedResponse(config.get(name))
        return FormattedResponse(status=HTTP_403_FORBIDDEN)
CVE-2021-21329: Improper Authentication (CWE-287)
value: RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enabled are able to log in without a valid token. This is fixed in commit cebb67b.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2021-03-08T18:15Z
Repository: https://github.com/ractf/core
Language: Python
Files changed: src/authentication/views.py
Commit date: 2021-02-26 11:41:20 +0000
Commit message: Merge pull request from GHSA-fw57-f7mq-9q85


Diff: diff --git a/src/authentication/views.py b/src/authentication/views.py
index 5dcb942..b0cfb32 100644
--- a/src/authentication/views.py
+++ b/src/authentication/views.py
@@ -148,11 +148,11 @@ class LoginTwoFactorView(APIView):
             for code in user.backup_codes:
                 if token == code.code:
                     code.delete()
                     return self.issue_token(user)
 
-        return self.issue_token(user)
+        return FormattedResponse(status=HTTP_401_UNAUTHORIZED, d={'reason': 'login_failed'}, m='login_failed')
 
 
 class RegenerateBackupCodesView(APIView):
     permission_classes = (permissions.IsAuthenticated & HasTwoFactor & ~IsBot,)
     serializer_class = serializers.LoginTwoFactorSerializer

Vulnerable code:         return self.issue_token(user)
Fixed code:         return FormattedResponse(status=HTTP_401_UNAUTHORIZED, d={'reason': 'login_failed'}, m='login_failed')
CVE-2019-12980: Integer Overflow or Wraparound (CWE-190)
value: In Ming (aka libming) 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the SWFInput_readSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 6.5
Published: 2019-06-26T18:15Z
Repository: https://github.com/libming/libming
Language: C
Files changed: src/blocks/input.c
Commit date: 2020-07-12 22:29:15 +0200
Commit message: Fix left shift of a negative value in SWFInput_readSBits. Check for number before before left-shifting by (number-1).

Diff: diff --git a/src/blocks/input.c b/src/blocks/input.c
index 478a0fe1..6e4a8320 100644
--- a/src/blocks/input.c
+++ b/src/blocks/input.c
@@ -111,11 +111,11 @@ SWFInput_readBits(SWFInput input, int number)
 int 
 SWFInput_readSBits(SWFInput input, int number)
 {
 	int num = SWFInput_readBits(input, number);
 
-	if ( num & (1<<(number-1)) )
+	if(number && num & (1<<(number-1)))
 		return num - (1<<number);
 	else
 		return num;
 }
 

Vulnerable code: 	if ( num & (1<<(number-1)) )
Fixed code: 	if(number && num & (1<<(number-1)))
CVE-2019-12981: Improper Input Validation (CWE-20)
value: Ming (aka libming) 0.4.8 has an "fill overflow" vulnerability in the function SWFShape_setLeftFillStyle in blocks/shape.c.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.8
Published: 2019-06-26T18:15Z
Repository: https://github.com/libming/libming
Language: C
Files changed: src/blocks/shape.c
Commit date: 2020-07-12 22:29:15 +0200
Commit message: SWFShape_setLeftFillStyle: prevent fill overflow

Diff: diff --git a/src/blocks/shape.c b/src/blocks/shape.c
index 67c81dcf..cfab7bca 100644
--- a/src/blocks/shape.c
+++ b/src/blocks/shape.c
@@ -1167,10 +1167,15 @@ SWFShape_setLeftFillStyle(SWFShape shape, SWFFillStyle fill)
 		SWFFillStyle_addDependency(fill, (SWFCharacter)shape);
 		if(addFillStyle(shape, fill) < 0)
 			return;		
 		idx = getFillIdx(shape, fill);
 	}
+	else if (idx >= 255 && shape->useVersion == SWF_SHAPE1)
+	{
+		SWF_error("Too many fills for SWFShape V1.\n" 
+			  "Use a higher SWFShape version\n");
+	}
 				
 	record = addStyleRecord(shape);
 	record.record.stateChange->leftFill = idx;
 	record.record.stateChange->flags |= SWF_SHAPE_FILLSTYLE0FLAG;
 }

Fixed code: 	else if (idx >= 255 && shape->useVersion == SWF_SHAPE1)
	{
		SWF_error("Too many fills for SWFShape V1.\n" 
			  "Use a higher SWFShape version\n");
	}
CVE-2019-12982: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Ming (aka libming) 0.4.8 has a heap buffer overflow and underflow in the decompileCAST function in util/decompile.c in libutil.a. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SWF file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2019-06-26T18:15Z
Repository: https://github.com/libming/libming
Language: C
Files changed: util/decompile.c
Commit date: 2020-07-12 22:29:15 +0200
Commit message: decompileAction: Prevent heap buffer overflow and underflow with using OpCode

Diff: diff --git a/util/decompile.c b/util/decompile.c
index e9341356..1df56da5 100644
--- a/util/decompile.c
+++ b/util/decompile.c
@@ -3200,19 +3200,18 @@ decompileCAST(int n, SWF_ACTION *actions, int maxn)
 }
 
 int
 decompileAction(int n, SWF_ACTION *actions, int maxn)
 {
-	if( n > maxn ) SWF_error("Action overflow!!");
 
 #ifdef DEBUG
 	fprintf(stderr,"%d:\tACTION[%3.3d]: %s\n",
 	        actions[n].SWF_ACTIONRECORD.Offset, n, 
 	        actionName(actions[n].SWF_ACTIONRECORD.ActionCode));
 #endif
 
-	switch(actions[n].SWF_ACTIONRECORD.ActionCode)
+	switch(OpCode(actions, n, maxn))
 	{
 	case SWFACTION_END:
 		return 0;
 
 	case SWFACTION_CONSTANTPOOL:

Vulnerable code: 	if( n > maxn ) SWF_error("Action overflow!!");
	switch(actions[n].SWF_ACTIONRECORD.ActionCode)
Fixed code: 	switch(OpCode(actions, n, maxn))
CVE-2021-41092: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2021-10-04T20:15Z
Repository: https://github.com/docker/cli
Language: Unknown
Commit date: 2021-09-09 20:40:54 +0200
Commit message: Merge pull request #2 from moby/cli-ghsa-99pg-grm5-qq3v-default-authconfig-20.10

[20.10] registry: ensure default auth config has address
CVE-2024-22199: Improper Encoding or Escaping of Output (CWE-116)
value: This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.

CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 6.1
Published: 2024-01-11T18:15Z
Repository: https://github.com/gofiber/template
Language: Unknown
Commit date: 2024-01-11 15:00:21 +0100
Commit message: Merge pull request #326 from gofiber/django-autoescape

fix: Django autoescape should be enable by default
CVE-2024-22199: Improper Input Validation (CWE-20)
value: This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.

CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.1
Published: 2024-01-11T18:15Z
Repository: https://github.com/gofiber/template
Language: Unknown
Commit date: 2024-01-11 15:00:21 +0100
Commit message: Merge pull request #326 from gofiber/django-autoescape

fix: Django autoescape should be enable by default
CVE-2024-22199: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.

CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2024-01-11T18:15Z
Repository: https://github.com/gofiber/template
Language: Unknown
Commit date: 2024-01-11 15:00:21 +0100
Commit message: Merge pull request #326 from gofiber/django-autoescape

fix: Django autoescape should be enable by default
CVE-2020-36633: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.1 is able to address this issue. The name of the patch is cd18d8b1afe464ae6626832496f4e070bac4c58f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216879.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2022-12-27T13:15Z
Repository: https://github.com/eberhardt/moodle-block_sitenews
Language: PHP
Files changed: block_sitenews.php, renderer.php
Commit date: 2020-01-10 14:12:16 +0000
Commit message: Add CSRF protection to item number setting

Diff: diff --git a/block_sitenews.php b/block_sitenews.php
index 2a1e4ac..173926b 100644
--- a/block_sitenews.php
+++ b/block_sitenews.php
@@ -62,11 +62,11 @@ class block_sitenews extends block_base {
         }
         $newsforumcm = get_coursemodule_from_instance('forum', $newsforum->id, $SITE->id, false, MUST_EXIST);
 
         $updatemynumber = optional_param("mynewsitems", -1, PARAM_INT);
         $displaysetting = block_sitenews_get_itemsnumber();
-        if ($updatemynumber >= 0 && $updatemynumber < 11) {
+        if ($updatemynumber >= 0 && $updatemynumber < 11 && confirm_sesskey()) {
             block_sitenews_update_itemsnumber($updatemynumber);
             $displaysetting = $items = $updatemynumber;
         }
         else {
             $items = $displaysetting;
diff --git a/renderer.php b/renderer.php
index 9ec6e75..438c123 100644
--- a/renderer.php
+++ b/renderer.php
@@ -56,10 +56,11 @@ class block_sitenews_renderer extends plugin_renderer_base {
 
         $url = new moodle_url("/my/index.php");
         $options = range(0,10);
         $options[0] = get_string("preset", "block_sitenews");
         $select = new single_select($url, "mynewsitems", $options, $selected, array());
+        $select->method = 'post';
         $select->set_label(get_string("newsitemsnumber") . ":");
         $output .= $this->output->render($select);
 
         $output .= $this->output->box_end();
         return $output;

Vulnerable code:         if ($updatemynumber >= 0 && $updatemynumber < 11) {
Fixed code:         if ($updatemynumber >= 0 && $updatemynumber < 11 && confirm_sesskey()) {
        $select->method = 'post';
CVE-2020-28460: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 8.1
Published: 2020-12-22T13:15Z
Repository: https://github.com/evangelion1204/multi-ini
Language: JSON
Files changed: README.md, package.json, src/parser.js, test/data/prototype_pollution.ini
Commit date: 2020-12-19 20:54:18 +0100
Commit message: Fixed 2nd issue with prototype pollution

Diff: diff --git a/README.md b/README.md
index 42b9433..c36f7ec 100644
--- a/README.md
+++ b/README.md
@@ -135,10 +135,16 @@ content = serializer.serialize({
 });
 ```
 
 ## Changelog
 
+### 2.1.2
+* Fixed prototype pollution by ignoring `constructor`
+
+### 2.1.1
+* Fixed prototype pollution by ignoring `__proto__`
+
 ### 1.0.1
 * Fixed bug with `keep_quotes` ignored when writing files
 
 ### 1.0.0
 * First full release keeping backwards compatibility
diff --git a/package.json b/package.json
index 14c5ea9..4614dc1 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "multi-ini",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "license": "MIT",
   "description": "An ini-file parser which supports multi line, multiple levels and arrays to get a maximum of compatibility with Zend config files.",
   "main": "lib/index.js",
   "scripts": {
     "predistribute": "babel src --out-dir lib",
diff --git a/src/parser.js b/src/parser.js
index 980b826..99338d9 100644
--- a/src/parser.js
+++ b/src/parser.js
@@ -18,11 +18,11 @@ const defaults = {
     oninvalid: () => true,
     filters: [],
     constants: {},
 };
 
-const REGEXP_IGNORE_KEYS = /__proto__/;
+const REGEXP_IGNORE_KEYS = /__proto__|constructor|prototype/;
 
 class Parser {
     constructor(options = {}) {
         this.options = Object.assign({}, defaults, options);
 
diff --git a/test/data/prototype_pollution.ini b/test/data/prototype_pollution.ini
index a235af3..62e5479 100644
--- a/test/data/prototype_pollution.ini
+++ b/test/data/prototype_pollution.ini
@@ -1,6 +1,10 @@
 [test]
 value=key
 [__proto__]
 polluted="polluted"
 [other]
-__proto__.path_polluted="polluted"
\ No newline at end of file
+__proto__.path_polluted="polluted"
+[constructor]
+prototype.polluted = polluted
+[prototype]
+polluted = polluted
\ No newline at end of file

Vulnerable code:   "version": "2.1.1",
const REGEXP_IGNORE_KEYS = /__proto__/;
__proto__.path_polluted="polluted"
Fixed code: ### 2.1.2
* Fixed prototype pollution by ignoring `constructor`

### 2.1.1
* Fixed prototype pollution by ignoring `__proto__`

  "version": "2.1.2",
const REGEXP_IGNORE_KEYS = /__proto__|constructor|prototype/;
__proto__.path_polluted="polluted"
[constructor]
prototype.polluted = polluted
[prototype]
polluted = polluted
CVE-2024-29189: Insufficient Information (NVD-CWE-noinfo)
value: PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-26T03:15Z
Repository: https://github.com/ansys/pyansys-geometry
Language: Python
Files changed: doc/changelog.d/1076.fixed.md, src/ansys/geometry/core/connection/product_instance.py
Commit date: 2024-03-21 17:45:48 +0100
Commit message: fix: prepare_and_start_backend is only available on Windows (#1076)

Co-authored-by: pyansys-ci-bot <pyansys.github.bot@ansys.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Diff: diff --git a/doc/changelog.d/1076.fixed.md b/doc/changelog.d/1076.fixed.md
new file mode 100644
index 0000000..3af1de6
--- /dev/null
+++ b/doc/changelog.d/1076.fixed.md
@@ -0,0 +1 @@
+fix: prepare_and_start_backend is only available on Windows
\ No newline at end of file
diff --git a/src/ansys/geometry/core/connection/product_instance.py b/src/ansys/geometry/core/connection/product_instance.py
index 19c9e53..1158ede 100644
--- a/src/ansys/geometry/core/connection/product_instance.py
+++ b/src/ansys/geometry/core/connection/product_instance.py
@@ -239,10 +239,13 @@ def prepare_and_start_backend(
     Modeler
         Instance of the Geometry service.
     """
     from ansys.geometry.core.modeler import Modeler
 
+    if os.name != "nt":  # pragma: no cover
+        raise RuntimeError("Method 'prepare_and_start_backend' is only available on Windows.")
+
     port = _check_port_or_get_one(port)
     installations = get_available_ansys_installations()
     if product_version != None:
         _check_version_is_available(product_version, installations)
     else:
@@ -417,11 +420,10 @@ def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Pop
     subprocess.Popen
         The subprocess object.
     """
     return subprocess.Popen(
         args,
-        shell=os.name != "nt",
         stdin=subprocess.DEVNULL,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,
         env=local_env,
     )

Vulnerable code:         shell=os.name != "nt",
Fixed code: fix: prepare_and_start_backend is only available on Windows
    if os.name != "nt":  # pragma: no cover
        raise RuntimeError("Method 'prepare_and_start_backend' is only available on Windows.")
CVE-2014-8483: Out-of-bounds Read (CWE-125)
value: The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a malformed string.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
Published: 2014-11-06T15:55Z
Repository: https://github.com/quassel/quassel
Language: C++
Files changed: src/core/cipher.cpp
Commit date: 2014-10-21 21:20:07 +0200
Commit message: Check for invalid input in encrypted buffers

The ECB Blowfish decryption function assumed that encrypted input would
always come in blocks of 12 characters, as specified. However, buggy
clients or annoying people may not adhere to that assumption, causing
the core to crash while trying to process the invalid base64 input.

With this commit we make sure that we're not overstepping the bounds of
the input string while decoding it; instead we bail out early and display
the original input. Fixes #1314.

Thanks to Tucos for finding that one!

Diff: diff --git a/src/core/cipher.cpp b/src/core/cipher.cpp
index 7cc75d0a..7d1fe46a 100644
--- a/src/core/cipher.cpp
+++ b/src/core/cipher.cpp
@@ -362,10 +362,14 @@ QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)
     {
         while ((temp.length() % 8) != 0) temp.append('\0');
     }
     else
     {
+        // ECB Blowfish encodes in blocks of 12 chars, so anything else is malformed input
+        if ((temp.length() % 12) != 0)
+            return cipherText;
+
         temp = b64ToByte(temp);
         while ((temp.length() % 8) != 0) temp.append('\0');
     }
 
     QCA::Direction dir = (direction) ? QCA::Encode : QCA::Decode;
@@ -374,12 +378,17 @@ QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)
     temp2 += cipher.final().toByteArray();
 
     if (!cipher.ok())
         return cipherText;
 
-    if (direction)
+    if (direction) {
+        // Sanity check
+        if ((temp2.length() % 8) != 0)
+            return cipherText;
+
         temp2 = byteToB64(temp2);
+    }
 
     return temp2;
 }
 
 

Vulnerable code:     if (direction)
Fixed code:         // ECB Blowfish encodes in blocks of 12 chars, so anything else is malformed input
        if ((temp.length() % 12) != 0)
            return cipherText;

    if (direction) {
        // Sanity check
        if ((temp2.length() % 8) != 0)
            return cipherText;

    }
CVE-2015-8547: DEPRECATED: Code (CWE-17)
value: The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *" command in a query.
CWE description: This entry has been deprecated.  It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CVSS v3 base score: 7.5
Published: 2016-01-08T19:59Z
Repository: https://github.com/quassel/quassel
Language: Unknown
Commit date: 2015-11-22 23:20:30 +0100
Commit message: Merge pull request #153 from elxa/fix-op-command-crashing-core

Fixes a crash of the core when executing "/op *" in a query.
CVE-2018-16153: Insufficiently Protected Credentials (CWE-522)
value: An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.
CWE description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS v3 base score: 7.5
Published: 2023-12-12T17:15Z
Repository: https://github.com/opencast/opencast
Language: Unknown
Commit date: 2021-12-13 14:01:23 -0600
Commit message: Merge pull request from GHSA-hcxx-mp6g-6gr9

Disable sending system digest credentials unless warranted
CVE-2021-32623: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (CWE-776)
value: Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue.
CWE description: The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
CVSS v3 base score: 6.5
Published: 2021-06-16T00:15Z
Repository: https://github.com/opencast/opencast
Language: Other
Files changed: assemblies/resources/bin/setenv
Commit date: 2021-06-15 12:36:31 +0200
Commit message: Clarifies debug options in setenv file (#2735)

Co-authored-by: Lars Kiesow <lkiesow@uos.de>
Diff: diff --git a/assemblies/resources/bin/setenv b/assemblies/resources/bin/setenv
index 2787580a89..16171f4f2b 100644
--- a/assemblies/resources/bin/setenv
+++ b/assemblies/resources/bin/setenv
@@ -29,12 +29,16 @@
 # export KARAF_HOME        # Karaf home folder
 # export KARAF_DATA        # Karaf data folder
 # export KARAF_BASE        # Karaf base folder
 # export KARAF_ETC         # Karaf etc  folder
 # export KARAF_OPTS        # Additional Karaf options
-# export KARAF_DEBUG       # Enable debug mode
 # export KARAF_REDIRECT    # Enable/set the std/err redirection when using bin/start
+#
+# Debug options
+# export KARAF_DEBUG       # Enable debug mode
+# export JAVA_DEBUG_PORT   # Set debug port (defaults to 5005)
+
 
 export EXTRA_JAVA_OPTS="${EXTRA_JAVA_OPTS} -Dorg.eclipse.jetty.server.Request.maxFormContentSize=1500000 -Dfile.encoding=UTF-8"
 export JAVA_MAX_MEM="${JAVA_MAX_MEM:-1G}"
 export JAVA_PERM_MEM="${JAVA_PERM_MEM:-256M}"
 export KARAF_NOROOT=true

Vulnerable code: # export KARAF_DEBUG       # Enable debug mode
Fixed code: #
# Debug options
# export KARAF_DEBUG       # Enable debug mode
# export JAVA_DEBUG_PORT   # Set debug port (defaults to 5005)
CVE-2021-43821: Files or Directories Accessible to External Parties (CWE-552)
value: Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface. Before Opencast 9.10 and 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine. An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given. The issue has been fixed in Opencast 10.6 and 11.0. You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.
CWE description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
CVSS v3 base score: 7.7
Published: 2021-12-14T20:15Z
Repository: https://github.com/opencast/opencast
Language: Unknown
Commit date: 2021-12-13 14:04:01 -0600
Commit message: Merge pull request from GHSA-59g4-hpg3-3gcp

Ensure local files are not addable
CVE-2022-41965: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-11-28T21:15Z
Repository: https://github.com/opencast/opencast
Language: HTML
Files changed: modules/engage-paella-player/src/main/paella-opencast/ui/auth.html
Commit date: 2022-08-26 10:29:10 +0200
Commit message: only redirect exact hostname matches

Diff: diff --git a/modules/engage-paella-player/src/main/paella-opencast/ui/auth.html b/modules/engage-paella-player/src/main/paella-opencast/ui/auth.html
index 67d8d37392e..22080e7a78f 100644
--- a/modules/engage-paella-player/src/main/paella-opencast/ui/auth.html
+++ b/modules/engage-paella-player/src/main/paella-opencast/ui/auth.html
@@ -17,17 +17,22 @@
 			});
 
 			var redirect = search['redirect'];
 			var id = search['id'];
 			var series = search['series'] || search['sid'] || search['epFrom'];
-			if (redirect != undefined) {
-				window.location.href = decodeURIComponent(redirect);
+			if (redirect !== undefined) {
+				let redirectDomain = new URL(redirect);
+				if (window.location.hostname.toUpperCase() === redirectDomain.hostname.toUpperCase()) {
+					window.location.href = decodeURIComponent(redirect);
+				} else {
+					window.location.href = "/engage/ui/index.html";
+				}
 			}
-			else if (id != undefined) {
+			else if (id !== undefined) {
 				window.location.href = "watch.html?id=" + id;
 			}
-			else if (series != undefined) {
+			else if (series !== undefined) {
 				window.location.href = "/engage/ui/index.html?epFrom=" + series;
 			}
 			else {
 				window.location.href = "/engage/ui/index.html";
 			}

Vulnerable code: 			if (redirect != undefined) {
				window.location.href = decodeURIComponent(redirect);
			else if (id != undefined) {
			else if (series != undefined) {
Fixed code: 			if (redirect !== undefined) {
				let redirectDomain = new URL(redirect);
				if (window.location.hostname.toUpperCase() === redirectDomain.hostname.toUpperCase()) {
					window.location.href = decodeURIComponent(redirect);
				} else {
					window.location.href = "/engage/ui/index.html";
				}
			else if (id !== undefined) {
			else if (series !== undefined) {
CVE-2022-27470: Out-of-bounds Write (CWE-787)
value: SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-05-04T03:15Z
Repository: https://github.com/libsdl-org/SDL_ttf
Language: C
Files changed: SDL_ttf.c
Commit date: 2022-03-19 20:40:28 +0100
Commit message: More integer overflow (see bug #187)
Make sure that 'width + alignment' doesn't overflow, otherwise
it could create a SDL_Surface of 'width' but with wrong 'pitch'

Diff: diff --git a/SDL_ttf.c b/SDL_ttf.c
index 1c19458..6a0956b 100644
--- a/SDL_ttf.c
+++ b/SDL_ttf.c
@@ -1255,11 +1255,11 @@ static SDL_Surface* Create_Surface_Solid(int width, int height, SDL_Color fg, Ui
      * - pitch is rounded to alignment
      * - adress is aligned
      */
     void *pixels, *ptr;
     /* Worse case at the end of line pulling 'alignment' extra blank pixels */
-    Sint64 pitch = width + alignment;
+    Sint64 pitch = (Sint64)width + (Sint64)alignment;
     pitch += alignment;
     pitch &= ~alignment;
     size = height * pitch + sizeof (void *) + alignment;
     if (size < 0 || size > SDL_MAX_SINT32) {
         /* Overflow... */
@@ -1319,11 +1319,11 @@ static SDL_Surface* Create_Surface_Shaded(int width, int height, SDL_Color fg, S
      * - pitch is rounded to alignment
      * - adress is aligned
      */
     void *pixels, *ptr;
     /* Worse case at the end of line pulling 'alignment' extra blank pixels */
-    Sint64 pitch = width + alignment;
+    Sint64 pitch = (Sint64)width + (Sint64)alignment;
     pitch += alignment;
     pitch &= ~alignment;
     size = height * pitch + sizeof (void *) + alignment;
     if (size < 0 || size > SDL_MAX_SINT32) {
         /* Overflow... */
@@ -1416,11 +1416,11 @@ static SDL_Surface *Create_Surface_Blended(int width, int height, SDL_Color fg,
          * - adress is aligned
          */
         Sint64 size;
         void *pixels, *ptr;
         /* Worse case at the end of line pulling 'alignment' extra blank pixels */
-        Sint64 pitch = (width + alignment) * 4;
+        Sint64 pitch = ((Sint64)width + (Sint64)alignment) * 4;
         pitch += alignment;
         pitch &= ~alignment;
         size = height * pitch + sizeof (void *) + alignment;
         if (size < 0 || size > SDL_MAX_SINT32) {
             /* Overflow... */

Vulnerable code:     Sint64 pitch = width + alignment;
    Sint64 pitch = width + alignment;
        Sint64 pitch = (width + alignment) * 4;
Fixed code:     Sint64 pitch = (Sint64)width + (Sint64)alignment;
    Sint64 pitch = (Sint64)width + (Sint64)alignment;
        Sint64 pitch = ((Sint64)width + (Sint64)alignment) * 4;
CVE-2022-24441: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2022-11-30T13:15Z
Repository: https://github.com/snyk/snyk-intellij-plugin
Language: Unknown
Commit date: 2022-11-29 13:23:22 +0100
Commit message: Merge pull request #417 from snyk/feat/trust

feat: add workspace trust feature
CVE-2021-32660: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@backstage/tehdocs-common` prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.1
Published: 2021-06-03T17:15Z
Repository: https://github.com/backstage/backstage
Language: Other
Files changed: .changeset/techdocs-fresh-and-clean.md, .github/styles/vocab.txt
Commit date: 2021-05-31 18:01:38 +0200
Commit message: Initial changeset.

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>

Diff: diff --git a/.changeset/techdocs-fresh-and-clean.md b/.changeset/techdocs-fresh-and-clean.md
new file mode 100644
index 000000000..52d9988c3
--- /dev/null
+++ b/.changeset/techdocs-fresh-and-clean.md
@@ -0,0 +1,6 @@
+---
+'@backstage/techdocs-common': patch
+'@backstage/plugin-techdocs': patch
+---
+
+Fixes multiple XSS and sanitization bypass vulnerabilities in TechDocs. For details, see [ link to security advisories here ] ...
diff --git a/.github/styles/vocab.txt b/.github/styles/vocab.txt
index b8f028a2a..d91b84029 100644
--- a/.github/styles/vocab.txt
+++ b/.github/styles/vocab.txt
@@ -208,10 +208,11 @@ routable
 Routable
 rst
 rsync
 ruleset
 sam
+sanitization
 scaffolded
 scaffolder
 Scaffolder
 seb
 semlas

Fixed code: ---
'@backstage/techdocs-common': patch
'@backstage/plugin-techdocs': patch
---

Fixes multiple XSS and sanitization bypass vulnerabilities in TechDocs. For details, see [ link to security advisories here ] ...
sanitization