Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-24045: Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
value: A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CWE description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVSS v3 base score: 9.8
Published: 2021-12-13T21:15Z
Repository: https://github.com/facebook/hermes
Language: C++
Files changed: lib/IR/IREval.cpp, test/hermes/tdz-check.js
Commit date: 2021-10-13 11:19:22 -0700
Commit message: Handle typeof applied to empty in InstSimplify

Summary:
Do not simplify `typeof` if it is applied to an invalid type. This
handles a case like the one in the added test, where `typeof` is called
on a literal empty in unreachable code.

Reviewed By: kodafb

Differential Revision: D31000173

fbshipit-source-id: 2d7f69cbcc9c1bb0a916585c07171089444c85dc

Diff: diff --git a/lib/IR/IREval.cpp b/lib/IR/IREval.cpp
index a07efd66d..3ddb40d74 100644
--- a/lib/IR/IREval.cpp
+++ b/lib/IR/IREval.cpp
@@ -105,11 +105,11 @@ Literal *hermes::evalUnaryOperator(
         case ValueKind::LiteralNumberKind:
           return builder.getLiteralString("number");
         case ValueKind::LiteralStringKind:
           return builder.getLiteralString("string");
         default:
-          llvm_unreachable("Invalid literal kind.");
+          break;
       }
       break;
 
     case UnaryOperatorInst::OpKind::BangKind:
       if (evalIsTrue(builder, operand)) {
diff --git a/test/hermes/tdz-check.js b/test/hermes/tdz-check.js
index 0533c1c49..fa82b26e8 100644
--- a/test/hermes/tdz-check.js
+++ b/test/hermes/tdz-check.js
@@ -43,5 +43,10 @@ test(() => {
     let x = init();
     function init(p1) { return p1 ? 10 : x; }
     return x;
 });
 //CHECK-NEXT: caught ReferenceError: accessing an uninitialized variable
+
+test(() => {
+    const foo = print(foo, typeof foo)
+});
+//CHECK-NEXT: caught ReferenceError: accessing an uninitialized variable

Vulnerable code:           llvm_unreachable("Invalid literal kind.");
Fixed code:           break;

test(() => {
    const foo = print(foo, typeof foo)
});
//CHECK-NEXT: caught ReferenceError: accessing an uninitialized variable
CVE-2022-35289: Integer Overflow or Wraparound (CWE-190)
value: A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2022-10-11T02:15Z
Repository: https://github.com/facebook/hermes
Language: C++
Files changed: lib/VM/detail/IdentifierHashTable.cpp
Commit date: 2022-08-02 13:52:30 -0700
Commit message: Re-sync with internal repository (#791)

Co-authored-by: Facebook Community Bot <6422482+facebook-github-bot@users.noreply.github.com>
Diff: diff --git a/lib/VM/detail/IdentifierHashTable.cpp b/lib/VM/detail/IdentifierHashTable.cpp
index bf4dc6469..7cfbb1985 100644
--- a/lib/VM/detail/IdentifierHashTable.cpp
+++ b/lib/VM/detail/IdentifierHashTable.cpp
@@ -136,10 +136,14 @@ void IdentifierHashTable::remove(const StringPrimitive *str) {
     remove(str->castToUTF16Ref());
   }
 }
 
 void IdentifierHashTable::growAndRehash(uint32_t newCapacity) {
+  // Guard against potential overflow in the calculation of new capacity.
+  if (LLVM_UNLIKELY(newCapacity <= capacity())) {
+    hermes_fatal("too many identifiers created");
+  }
   assert(llvh::isPowerOf2_32(newCapacity) && "capacity must be power of 2");
   CompactTable tmpTable(newCapacity, table_.getCurrentScale());
   tmpTable.swap(table_);
   for (uint32_t oldIdx = 0; oldIdx < tmpTable.size(); ++oldIdx) {
     if (!tmpTable.isValid(oldIdx)) {

Fixed code:   // Guard against potential overflow in the calculation of new capacity.
  if (LLVM_UNLIKELY(newCapacity <= capacity())) {
    hermes_fatal("too many identifiers created");
  }
CVE-2016-9132: Integer Overflow or Wraparound (CWE-190)
value: In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2017-01-30T22:59Z
Repository: https://github.com/randombit/botan
Language: Unknown
Commit date: 2016-11-28 05:31:02 -0500
Commit message: Fix BER decoder integer overflow
CVE-2024-34702: Insufficient Information (NVD-CWE-noinfo)
value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-08T17:15Z
Repository: https://github.com/randombit/botan
Language: Unknown
Commit date: 2024-05-13 06:49:29 -0400
Commit message: Merge pull request #4045 from randombit/jack/x509-path-sigs-first

During X509 path validation, return immediately if a signature is invalid
CVE-2024-34702: Insufficient Information (NVD-CWE-noinfo)
value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-08T17:15Z
Repository: https://github.com/randombit/botan
Language: Unknown
Commit date: 2024-05-10 05:02:43 -0400
Commit message: Merge pull request #4034 from randombit/jack/refactor-alt-name

Refactor AlternativeName internals
CVE-2024-34702: Insufficient Information (NVD-CWE-noinfo)
value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-08T17:15Z
Repository: https://github.com/randombit/botan
Language: Unknown
Commit date: 2024-05-14 04:37:15 -0400
Commit message: Merge pull request #4047 from randombit/jack/opt-name-constraints

Optimize name constraint matching
CVE-2024-34702: Insufficient Information (NVD-CWE-noinfo)
value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-08T17:15Z
Repository: https://github.com/randombit/botan
Language: Unknown
Commit date: 2024-07-08 10:39:41 -0400
Commit message: Merge pull request #4186 from randombit/jack/fix-nc-dos

Address denial of service in name constraints processing
CVE-2024-34703: Insufficient Information (NVD-CWE-noinfo)
value: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-30T21:15Z
Repository: https://github.com/randombit/botan
Language: Unknown
Commit date: 2024-02-20 07:52:20 -0500
Commit message: Merge pull request #3913 from randombit/jack/limit-ecc-curve-size

When decoding an arbitrary elliptic curve, set an upper bound on length
CVE-2022-29245: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)
value: SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes. When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with a weak random number generator whose seed can be brute forced. This allows an attacker who is able to eavesdrop on the communications to decrypt them. Version 2020.0.2 contains a patch for this issue. As a workaround, one may disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms.
CWE description: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CVSS v3 base score: 5.9
Published: 2022-05-31T17:15Z
Repository: https://github.com/sshnet/SSH.NET
Language: C#
Files changed: src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs
Commit date: 2022-05-29 16:58:07 +0200
Commit message: Use cryptographically secure random number generator.
Fixes CVE-2022-29245.

Diff: diff --git a/src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs b/src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs
index 9de7af8f..1fba1c20 100644
--- a/src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs
+++ b/src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs
@@ -44,13 +44,11 @@ public override void Start(Session session, KeyExchangeInitMessage message)
             Session.KeyExchangeEcdhReplyMessageReceived += Session_KeyExchangeEcdhReplyMessageReceived;
 
             var basepoint = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             basepoint[0] = 9;
 
-            var rnd = new Random();
-            _privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
-            rnd.NextBytes(_privateKey);
+            _privateKey = CryptoAbstraction.GenerateRandom(MontgomeryCurve25519.PrivateKeySizeInBytes);
 
             _clientExchangeValue = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             MontgomeryOperations.scalarmult(_clientExchangeValue, 0, _privateKey, 0, basepoint, 0);
 
             SendMessage(new KeyExchangeEcdhInitMessage(_clientExchangeValue));

Vulnerable code:             var rnd = new Random();
            _privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
            rnd.NextBytes(_privateKey);
Fixed code:             _privateKey = CryptoAbstraction.GenerateRandom(MontgomeryCurve25519.PrivateKeySizeInBytes);
CVE-2022-21667: Improper Handling of Exceptional Conditions (CWE-755)
value: soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with the Pusher Protocol, it will crash the server. All users that run the server are affected by this vulnerability and it's highly recommended to upgrade to the latest patch. There are no workarounds for this issue.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 7.5
Published: 2022-01-10T14:12Z
Repository: https://github.com/soketi/soketi
Language: Unknown
Commit date: 2022-01-07 13:26:17 +0200
Commit message: Merge pull request #246 from soketi/fix/crash-on-empty-post

[fix] Do not close the connection on empty POST payload
CVE-2022-2061: Out-of-bounds Write (CWE-787)
value: Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 3.3
Published: 2022-06-13T12:15Z
Repository: https://github.com/hpjansson/chafa
Language: C
Files changed: libnsgif/lzw.c
Commit date: 2022-06-09 21:18:17 +0200
Commit message: libnsgif: fix oob in lzw_decode

Diff: diff --git a/libnsgif/lzw.c b/libnsgif/lzw.c
index 2282898..152892e 100644
--- a/libnsgif/lzw.c
+++ b/libnsgif/lzw.c
@@ -327,10 +327,14 @@ lzw_result lzw_decode(struct lzw_ctx *ctx,
 
 	} else if (code_new > current_entry) {
 		/* Code is invalid */
 		return LZW_BAD_CODE;
 
+	} else if (code_new >= 1 << LZW_CODE_MAX) {
+		/* Don't access out of bound */
+		return LZW_BAD_CODE;
+
 	} else if (code_new < current_entry) {
 		/* Code is in table */
 		code_out = code_new;
 		last_value = table[code_new].first_value;
 	} else {

Fixed code: 	} else if (code_new >= 1 << LZW_CODE_MAX) {
		/* Don't access out of bound */
		return LZW_BAD_CODE;
CVE-2019-10864: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-04-23T18:29Z
Repository: https://github.com/wp-statistics/wp-statistics
Language: PHP
Files changed: includes/functions/functions.php
Commit date: 2019-04-09 10:58:48 +0430
Commit message: fix xss Attach Get Title Of Page

Diff: diff --git a/includes/functions/functions.php b/includes/functions/functions.php
index fc41bb8a..ed6149be 100644
--- a/includes/functions/functions.php
+++ b/includes/functions/functions.php
@@ -2092,11 +2092,11 @@ function wp_statistics_get_site_title( $url ) {
 		@$dom->loadHTML( $html );
 		$title = '';
 		if ( isset( $dom ) and $dom->getElementsByTagName( 'title' )->length > 0 ) {
 			$title = $dom->getElementsByTagName( 'title' )->item( '0' )->nodeValue;
 		}
-		return ( wp_strip_all_tags( $title ) == "" ? false : $title );
+		return ( wp_strip_all_tags( $title ) == "" ? false : wp_strip_all_tags( $title ) );
 	}
 
 	return false;
 }
 

Vulnerable code: 		return ( wp_strip_all_tags( $title ) == "" ? false : $title );
Fixed code: 		return ( wp_strip_all_tags( $title ) == "" ? false : wp_strip_all_tags( $title ) );
CVE-2020-26230: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and de-anonymization of COVID-19 positive users when using Radar COVID. The vulnerability is caused by the fact that Radar COVID connections to the server (uploading of TEKs to the backend) are only made by COVID-19 positives. Therefore, any on-path observer with the ability to monitor traffic between the app and the server can identify which users had a positive test. Such an adversary can be the mobile network operator (MNO) if the connection is done through a mobile network, the Internet Service Provider (ISP) if the connection is done through the Internet (e.g., a home network), a VPN provider used by the user, the local network operator in the case of enterprise networks, or any eavesdropper with access to the same network (WiFi or Ethernet) as the user as could be the case of public WiFi hotspots deployed at shopping centers, airports, hotels, and coffee shops. The attacker may also de-anonymize the user. For this additional stage to succeed, the adversary needs to correlate Radar COVID traffic to other identifiable information from the victim. This could be achieved by associating the connection to a contract with the name of the victim or by associating Radar COVID traffic to other user-generated flows containing identifiers in the clear (e.g., HTTP cookies or other mobile flows sending unique identifiers like the IMEI or the AAID without encryption). The former can be executed, for instance, by the Internet Service Provider or the MNO. The latter can be executed by any on-path adversary, such as the network provider or even the cloud provider that hosts more than one service accessed by the victim. The farther the adversary is either from the victim (the client) or the end-point (the server), the less likely it may be that the adversary has access to re-identification information. The vulnerability has been mitigated with the injection of dummy traffic from the application to the backend. Dummy traffic is generated by all users independently of whether they are COVID-19 positive or not. The issue was fixed in iOS in version 1.0.8 (uniform distribution), 1.1.0 (exponential distribution), Android in version 1.0.7 (uniform distribution), 1.1.0 (exponential distribution), Backend in version 1.1.2-RELEASE. For more information see the referenced GitHub Security Advisory.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2020-11-13T19:15Z
Repository: https://github.com/RadarCOVID/radar-covid-ios
Language: Unknown
Commit date: 2020-10-30 05:32:05 -0400
Commit message: chore: release 1.1.0
CVE-2019-17426: Insufficient Information (NVD-CWE-noinfo)
value: Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.1
Published: 2019-10-10T02:05Z
Repository: https://github.com/Automattic/mongoose
Language: JavaScript
Files changed: lib/cast.js
Commit date: 2019-10-09 18:41:25 -0400
Commit message: fix(query): delete top-level `_bsontype` property in queries to prevent silent empty queries

Fix #8222

Diff: diff --git a/lib/cast.js b/lib/cast.js
index 928fe9d1..3dfd651a 100644
--- a/lib/cast.js
+++ b/lib/cast.js
@@ -25,10 +25,16 @@ const ALLOWED_GEOWITHIN_GEOJSON_TYPES = ['Polygon', 'MultiPolygon'];
 module.exports = function cast(schema, obj, options, context) {
   if (Array.isArray(obj)) {
     throw new Error('Query filter must be an object, got an array ', util.inspect(obj));
   }
 
+  // bson 1.x has the unfortunate tendency to remove filters that have a top-level
+  // `_bsontype` property. Should remove this when we upgrade to bson 4.x. See gh-8222
+  if (obj.hasOwnProperty('_bsontype')) {
+    delete obj._bsontype;
+  }
+
   const paths = Object.keys(obj);
   let i = paths.length;
   let _keys;
   let any$conditionals;
   let schematype;

Fixed code:   // bson 1.x has the unfortunate tendency to remove filters that have a top-level
  // `_bsontype` property. Should remove this when we upgrade to bson 4.x. See gh-8222
  if (obj.hasOwnProperty('_bsontype')) {
    delete obj._bsontype;
  }
CVE-2019-19324: Always-Incorrect Control Flow Implementation (CWE-670)
value: Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance.
CWE description: The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CVSS v3 base score: 7.5
Published: 2020-03-20T18:15Z
Repository: https://github.com/xmidt-org/cjwt
Language: Unknown
Commit date: 2019-11-25 14:11:28 -0800
Commit message: Merge pull request #29 from xmidt-org/correct-return-codes-and-eliminiate-silent-failure

Correct return codes and eliminiate silent failure
CVE-2014-125044: Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
value: A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of the argument p leads to file inclusion. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is named 567bc33e6ed82b0d0179c9add707ac2b257aeaf2. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217515.
CWE description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CVSS v3 base score: 9.8
Published: 2023-01-05T20:15Z
Repository: https://github.com/soshtolsus/wing-tight
Language: PHP
Files changed: index.php
Commit date: 2014-10-28 00:36:21 -0500
Commit message: hardened index against malicious ?p= attacks

Diff: diff --git a/index.php b/index.php
index a6e172c..962fba4 100644
--- a/index.php
+++ b/index.php
@@ -6,11 +6,22 @@
 		<div class="header hflex">
 			<?php include('parts/header.html.part'); ?>
 		</div>
 		<div class="center hflex">
 			<div class="page">
-				<?php include('pages/' . array_merge(array('p'=>'home'), $_GET)['p'] . '.html.part'); ?>
+				<?php
+					$page_spec = array_merge(array('p'=>'home'), $_GET)['p'];
+					
+					if (strpos($page_spec, '/') === false)
+					{
+						include("{$_SERVER['DOCUMENT_ROOT']}/pages/$page_spec.html.part");
+					}
+					else
+					{
+						echo 'no one here but us chickens';
+					}
+				?>
 			</div>
 			<div class="sidebar">
 				<?php include('parts/sidebar.html.part'); ?>
 			</div>
 		</div>

Vulnerable code: 				<?php include('pages/' . array_merge(array('p'=>'home'), $_GET)['p'] . '.html.part'); ?>
Fixed code: 				<?php
					$page_spec = array_merge(array('p'=>'home'), $_GET)['p'];
					
					if (strpos($page_spec, '/') === false)
					{
						include("{$_SERVER['DOCUMENT_ROOT']}/pages/$page_spec.html.part");
					}
					else
					{
						echo 'no one here but us chickens';
					}
				?>
CVE-2016-2138: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.class.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.4
Published: 2022-07-28T15:15Z
Repository: https://github.com/ikoniaris/kippo-graph
Language: PHP
Files changed: class/KippoInput.class.php, include/play.php
Commit date: 2015-06-18 02:15:27 +0100
Commit message: Block XSS in wget commands (file links)

Diff: diff --git a/class/KippoInput.class.php b/class/KippoInput.class.php
index 36eef7c..34f3279 100644
--- a/class/KippoInput.class.php
+++ b/class/KippoInput.class.php
@@ -442,11 +442,11 @@ class KippoInput
             foreach($rows as $row) {
                 echo '<tr class="light word-break">';
                 echo '<td>' . $counter . '</td>';
                 echo '<td>' . $row['timestamp'] . '</td>';
                 echo '<td>' . xss_clean($row['input']) . '</td>';
-                $file_link = explode(" ", trim($row['file']))[0];
+                $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
                 // If the link has no "http://" in front, then add it
                 if (substr(strtolower($file_link), 0, 4) !== 'http') {
                     $file_link = 'http://' . $file_link;
                 }
                 echo '<td><a href="http://anonym.to/?' . $file_link . '" target="_blank"><img class="icon" src="images/warning.png"/>http://anonym.to/?' . $file_link . '</a></td>';
diff --git a/include/play.php b/include/play.php
index 1f5ad5e..0da4223 100644
--- a/include/play.php
+++ b/include/play.php
@@ -121,11 +121,11 @@
                 foreach ($rows as $row) {
                     echo '<tr class="light word-break">';
                     echo '<td>' . $counter . '</td>';
                     echo '<td>' . $row['timestamp'] . '</td>';
                     echo '<td>' . xss_clean($row['input']) . '</td>';
-                    $file_link = trim($row['file']);
+                    $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
                     // If the link has no "http://" in front, then add it
                     if (substr(strtolower($file_link), 0, 4) !== 'http') {
                         $file_link = 'http://' . $file_link;
                     }
                     echo '<td><a href="http://anonym.to/?' . $file_link . '" target="_blank"><img class="icon" src="../images/warning.png"/>http://anonym.to/?' . $file_link . '</a></td>';

Vulnerable code:                 $file_link = explode(" ", trim($row['file']))[0];
                    $file_link = trim($row['file']);
Fixed code:                 $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
                    $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
CVE-2016-2139: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file_link in class/KippoInput.class.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.4
Published: 2022-07-28T15:15Z
Repository: https://github.com/ikoniaris/kippo-graph
Language: PHP
Files changed: class/KippoInput.class.php, include/play.php
Commit date: 2015-06-18 02:15:27 +0100
Commit message: Block XSS in wget commands (file links)

Diff: diff --git a/class/KippoInput.class.php b/class/KippoInput.class.php
index 36eef7c..34f3279 100644
--- a/class/KippoInput.class.php
+++ b/class/KippoInput.class.php
@@ -442,11 +442,11 @@ class KippoInput
             foreach($rows as $row) {
                 echo '<tr class="light word-break">';
                 echo '<td>' . $counter . '</td>';
                 echo '<td>' . $row['timestamp'] . '</td>';
                 echo '<td>' . xss_clean($row['input']) . '</td>';
-                $file_link = explode(" ", trim($row['file']))[0];
+                $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
                 // If the link has no "http://" in front, then add it
                 if (substr(strtolower($file_link), 0, 4) !== 'http') {
                     $file_link = 'http://' . $file_link;
                 }
                 echo '<td><a href="http://anonym.to/?' . $file_link . '" target="_blank"><img class="icon" src="images/warning.png"/>http://anonym.to/?' . $file_link . '</a></td>';
diff --git a/include/play.php b/include/play.php
index 1f5ad5e..0da4223 100644
--- a/include/play.php
+++ b/include/play.php
@@ -121,11 +121,11 @@
                 foreach ($rows as $row) {
                     echo '<tr class="light word-break">';
                     echo '<td>' . $counter . '</td>';
                     echo '<td>' . $row['timestamp'] . '</td>';
                     echo '<td>' . xss_clean($row['input']) . '</td>';
-                    $file_link = trim($row['file']);
+                    $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
                     // If the link has no "http://" in front, then add it
                     if (substr(strtolower($file_link), 0, 4) !== 'http') {
                         $file_link = 'http://' . $file_link;
                     }
                     echo '<td><a href="http://anonym.to/?' . $file_link . '" target="_blank"><img class="icon" src="../images/warning.png"/>http://anonym.to/?' . $file_link . '</a></td>';

Vulnerable code:                 $file_link = explode(" ", trim($row['file']))[0];
                    $file_link = trim($row['file']);
Fixed code:                 $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
                    $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
CVE-2017-9432: Out-of-bounds Write (CWE-787)
value: Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-06-05T03:29Z
Repository: https://github.com/fosnola/libstaroffice
Language: Other
Files changed: src/lib/StarWriterStruct.cxx
Commit date: 2017-04-07 19:28:55 +0200
Commit message: ofz#1029 use correct loop index

To be honest, I think this would be clearer as two separate reads to two
separate vars...

Diff: diff --git a/src/lib/StarWriterStruct.cxx b/src/lib/StarWriterStruct.cxx
index 5893302..d1ad366 100644
--- a/src/lib/StarWriterStruct.cxx
+++ b/src/lib/StarWriterStruct.cxx
@@ -325,11 +325,11 @@ bool DatabaseName::read(StarZone &zone)
           f << "###dbDataName";
           break;
         }
         data.m_name=libstoff::getString(text);
         int positions[2];
-        for (int j=0; j<2; ++j) positions[i]=int(input->readULong(4));
+        for (int j=0; j<2; ++j) positions[j]=int(input->readULong(4));
         data.m_selection=STOFFVec2i(positions[0],positions[1]);
         m_dataList.push_back(data);
       }
     }
   }

Vulnerable code:         for (int j=0; j<2; ++j) positions[i]=int(input->readULong(4));
Fixed code:         for (int j=0; j<2; ++j) positions[j]=int(input->readULong(4));
CVE-2022-29174: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 8.1
Published: 2022-05-17T21:15Z
Repository: https://github.com/Countly/countly-server
Language: JavaScript
Files changed: frontend/express/libs/members.js
Commit date: 2022-05-05 12:44:27 +0300
Commit message: [members] secure password reset token generation

Diff: diff --git a/frontend/express/libs/members.js b/frontend/express/libs/members.js
index e53a87327..5adf2aaad 100644
--- a/frontend/express/libs/members.js
+++ b/frontend/express/libs/members.js
@@ -807,11 +807,11 @@ membersUtility.forgot = function(req, callback) {
     else {
         var email = (req.body.email + "").trim();
         membersUtility.db.collection('members').findOne({"email": email}, function(err, member) {
             if (member) {
                 var timestamp = Math.round(new Date().getTime() / 1000),
-                    prid = sha512Hash(member.username + member.full_name, timestamp);
+                    prid = crypto.randomBytes(32).toString('hex');
                 member.lang = member.lang || req.body.lang || "en";
                 membersUtility.db.collection('password_reset').insert({"prid": prid, "user_id": member._id, "timestamp": timestamp}, {safe: true}, function() {
                     countlyMail.sendPasswordResetInfo(member, prid);
                     plugins.callMethod("passwordRequest", {req: req, data: req.body}); //used in systemlogs
                     callback(member);

Vulnerable code:                     prid = sha512Hash(member.username + member.full_name, timestamp);
Fixed code:                     prid = crypto.randomBytes(32).toString('hex');
CVE-2021-3749: Inefficient Regular Expression Complexity (CWE-1333)
value: axios is vulnerable to Inefficient Regular Expression Complexity
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2021-08-31T11:15Z
Repository: https://github.com/axios/axios
Language: JavaScript
Files changed: lib/utils.js
Commit date: 2021-08-30 14:33:43 +0200
Commit message: Security fix for ReDoS (#3980)


Diff: diff --git a/lib/utils.js b/lib/utils.js
index 28ccfff..5d966f4 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -183,11 +183,11 @@ function isURLSearchParams(val) {
  *
  * @param {String} str The String to trim
  * @returns {String} The String freed of excess whitespace
  */
 function trim(str) {
-  return str.replace(/^\s*/, '').replace(/\s*$/, '');
+  return str.trim ? str.trim() : str.replace(/^\s+|\s+$/g, '');
 }
 
 /**
  * Determine if we're running in a standard browser environment
  *

Vulnerable code:   return str.replace(/^\s*/, '').replace(/\s*$/, '');
Fixed code:   return str.trim ? str.trim() : str.replace(/^\s+|\s+$/g, '');
CVE-2015-10011: Improper Encoding or Escaping of Output (CWE-116)
value: A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoints.py. The manipulation leads to improper output neutralization for logs. The identifier of the patch is 9eba6ba5abd89d0e36a008921eb307fcef8c5311. It is recommended to apply a patch to fix this issue. The identifier VDB-217197 was assigned to this vulnerability.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 9.8
Published: 2023-01-02T22:15Z
Repository: https://github.com/opendns/OpenResolve
Language: Python
Files changed: resolverapi/endpoints.py
Commit date: 2015-08-03 16:19:02 -0700
Commit message: Log Injection Attack Vulnerability

By logging the unsanitized user input, a log injection attack can
occur. This commit removes user-provided values from the logs.

Diff: diff --git a/resolverapi/endpoints.py b/resolverapi/endpoints.py
index 5e1c688..aa80958 100644
--- a/resolverapi/endpoints.py
+++ b/resolverapi/endpoints.py
@@ -16,11 +16,11 @@ class LookupRecordType(Resource):
     def get(self, rdtype, domain):
         t1 = time.time()
 
         rdtype = rdtype.upper()
         current_app.logger.info(
-            'Request from %s - %s %s', request.remote_addr, rdtype, domain)
+            'Request from %s - %s', request.remote_addr, rdtype)
         self.valid_args(rdtype, domain)
 
         # Iterate through nameservers so that we can tell which one gets used.
         nameservers = current_app.config['RESOLVERS']
         for nameserver in nameservers:

Vulnerable code:             'Request from %s - %s %s', request.remote_addr, rdtype, domain)
Fixed code:             'Request from %s - %s', request.remote_addr, rdtype)
CVE-2022-4905: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 is able to address this issue. The patch is identified as 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. It is recommended to upgrade the affected component. VDB-220750 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-13T21:15Z
Repository: https://github.com/udx/wp-stateless
Language: PHP
Files changed: lib/classes/class-settings.php
Commit date: 2022-05-06 11:26:36 +0300
Commit message: vulnerability fix

Diff: diff --git a/lib/classes/class-settings.php b/lib/classes/class-settings.php
index f6bfa3fb..1ae6a599 100644
--- a/lib/classes/class-settings.php
+++ b/lib/classes/class-settings.php
@@ -513,15 +513,18 @@ namespace wpCloud\StatelessMedia {
        * @author alim@UD
        */
       public function save_media_settings(){
         if(isset($_POST['action']) && $_POST['action'] == 'stateless_settings' && wp_verify_nonce( $_POST['_smnonce'], 'wp-stateless-settings' )){
 
-          $settings = apply_filters('stateless::settings::save', sanitize_text_field($_POST['sm']));
+          $settings = apply_filters('stateless::settings::save', $_POST['sm']);
           $root_dir_value = false;
 
           foreach ( $settings as $name => $value ) {
-
+            /**
+             * Sanitize POST data
+             */
+            $value = sanitize_text_field($value);
             /**
              * root_dir settings
              */
             if ( 'root_dir' == $name && is_array($value) ) {
               //managed in WP-Stateless settings (via Bucket Folder control)

Vulnerable code:           $settings = apply_filters('stateless::settings::save', sanitize_text_field($_POST['sm']));

Fixed code:           $settings = apply_filters('stateless::settings::save', $_POST['sm']);
            /**
             * Sanitize POST data
             */
            $value = sanitize_text_field($value);
CVE-2022-32983: Authentication Bypass by Spoofing (CWE-290)
value: Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filters.
CWE description: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CVSS v3 base score: 5.3
Published: 2022-06-20T16:15Z
Repository: https://github.com/CZ-NIC/knot-resolver
Language: Other
Files changed: modules/policy/README.rst
Commit date: 2021-12-22 11:14:09 +0100
Commit message: policy docs: warn about filters and forwarding

We've been notified about possibility of "cache poisoning" this way,
so let's document this drawback to make the expectations clearer.

Diff: diff --git a/modules/policy/README.rst b/modules/policy/README.rst
index 33b26654..10131625 100644
--- a/modules/policy/README.rst
+++ b/modules/policy/README.rst
@@ -405,10 +405,24 @@ Actions :func:`policy.FORWARD`, :func:`policy.TLS_FORWARD` and :func:`policy.STU
 .. note:: By default, forwarding targets must support
    `EDNS <https://en.wikipedia.org/wiki/Extension_mechanisms_for_DNS>`_ and
    `0x20 randomization <https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00>`_.
    See example in `Replacing part of the DNS tree`_.
 
+.. warning::
+   Limiting forwarding actions by filters (e.g. :func:`policy.suffix`) may have unexpected consequences.
+   Notably, forwarders can inject *any* records into your cache
+   even if you "restrict" them to an insignificant DNS subtree --
+   except in cases where DNSSEC validation applies, of course.
+
+   The behavior is probably best understood through the fact
+   that filters and actions are completely decoupled.
+   The forwarding actions have no clue about why they were executed,
+   e.g. that the user wanted to restrict the forwarder only to some subtree.
+   The action just selects some set of forwarders to process this whole request from the client,
+   and during that processing it might need some other "sub-queries" (e.g. for validation).
+   Some of those might not've passed the intended filter,
+   but policy rule-set only applies once per client's request.
 
 .. _tls-forwarding:
 
 Forwarding over TLS protocol (DNS-over-TLS)
 -------------------------------------------

Fixed code: .. warning::
   Limiting forwarding actions by filters (e.g. :func:`policy.suffix`) may have unexpected consequences.
   Notably, forwarders can inject *any* records into your cache
   even if you "restrict" them to an insignificant DNS subtree --
   except in cases where DNSSEC validation applies, of course.

   The behavior is probably best understood through the fact
   that filters and actions are completely decoupled.
   The forwarding actions have no clue about why they were executed,
   e.g. that the user wanted to restrict the forwarder only to some subtree.
   The action just selects some set of forwarders to process this whole request from the client,
   and during that processing it might need some other "sub-queries" (e.g. for validation).
   Some of those might not've passed the intended filter,
   but policy rule-set only applies once per client's request.
CVE-2022-4957: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in librespeed speedtest up to 5.2.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file results/stats.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. Upgrading to version 5.2.5 is able to address this issue. The patch is named a85f2c086f3449dffa8fe2edb5e2ef3ee72dc0e9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-246643.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-12-03T19:15Z
Repository: https://github.com/librespeed/speedtest
Language: PHP
Files changed: results/stats.php
Commit date: 2022-01-03 16:30:39 +0100
Commit message: Fixed minor vulnerability in stats.php

Diff: diff --git a/results/stats.php b/results/stats.php
index be35a6e..b8fbee8 100755
--- a/results/stats.php
+++ b/results/stats.php
@@ -84,13 +84,13 @@ header('Pragma: no-cache');
                 <?php
                 if ($_GET['op'] === 'id' && !empty($_GET['id'])) {
                     $speedtest = getSpeedtestUserById($_GET['id']);
                     $speedtests = [];
                     if (false === $speedtest) {
-                        echo '<div>There was an error trying to fetch the speedtest result for ID "'.$_GET['id'].'".</div>';
+                        echo '<div>There was an error trying to fetch the speedtest result for ID "'.htmlspecialchars($_GET['id'], ENT_HTML5, 'UTF-8').'".</div>';
                     } elseif (null === $speedtest) {
-                        echo '<div>Could not find a speedtest result for ID "'.$_GET['id'].'".</div>';
+                        echo '<div>Could not find a speedtest result for ID "'.htmlspecialchars($_GET['id'], ENT_HTML5, 'UTF-8').'".</div>';
                     } else {
                         $speedtests = [$speedtest];
                     }
                 } else {
                     $speedtests = getLatestSpeedtestUsers();

Vulnerable code:                         echo '<div>There was an error trying to fetch the speedtest result for ID "'.$_GET['id'].'".</div>';
                        echo '<div>Could not find a speedtest result for ID "'.$_GET['id'].'".</div>';
Fixed code:                         echo '<div>There was an error trying to fetch the speedtest result for ID "'.htmlspecialchars($_GET['id'], ENT_HTML5, 'UTF-8').'".</div>';
                        echo '<div>Could not find a speedtest result for ID "'.htmlspecialchars($_GET['id'], ENT_HTML5, 'UTF-8').'".</div>';