Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-21236: Uncontrolled Resource Consumption (CWE-400)
value: CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2021-01-06T17:15Z
Repository: https://github.com/Kozea/CairoSVG
Language: Unknown
Commit date: 2021-01-06 15:43:14 +0100
Commit message: Merge pull request from GHSA-hq37-853p-g5cf

Don’t use overlapping groups for regular expressions
CVE-2023-27586: Server-Side Request Forgery (SSRF) (CWE-918)
value: CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.1
Published: 2023-03-20T16:15Z
Repository: https://github.com/Kozea/CairoSVG
Language: Other
Files changed: NEWS.rst, cairosvg/VERSION
Commit date: 2023-03-20 15:31:24 +0100
Commit message: Version 2.7.0

Diff: diff --git a/NEWS.rst b/NEWS.rst
index f6401c9b..3f5220cf 100644
--- a/NEWS.rst
+++ b/NEWS.rst
@@ -1,10 +1,22 @@
 ======
  News
 ======
 
 
+Version 2.7.0 released on 2023-03-20
+====================================
+
+**WARNING:** this is a security update.
+
+When processing SVG files, CairoSVG could access other files online, possibly
+leading to very long renderings or other security problems.
+
+This feature is now disabled by default. External resources can still be
+accessed using the "unsafe" or the "url_fetcher" parameter.
+
+
 Version 2.6.0 released on 2023-01-12
 ====================================
 
 * Drop support of Python 3.5 and 3.6, add support of Python 3.9, 3.10 and 3.11
 * Support crispEdges value for text antialiasing
diff --git a/cairosvg/VERSION b/cairosvg/VERSION
index 914ec967..9aa34646 100644
--- a/cairosvg/VERSION
+++ b/cairosvg/VERSION
@@ -1 +1 @@
-2.6.0
\ No newline at end of file
+2.7.0
\ No newline at end of file

Vulnerable code: 2.6.0
Fixed code: Version 2.7.0 released on 2023-03-20
====================================

**WARNING:** this is a security update.

When processing SVG files, CairoSVG could access other files online, possibly
leading to very long renderings or other security problems.

This feature is now disabled by default. External resources can still be
accessed using the "unsafe" or the "url_fetcher" parameter.


2.7.0
CVE-2017-18190: Authentication Bypass by Spoofing (CWE-290)
value: A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
CWE description: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CVSS v3 base score: 7.5
Published: 2018-02-16T17:29Z
Repository: https://github.com/apple/cups
Language: C
Files changed: scheduler/client.c
Commit date: 2017-01-03 13:52:47 -0500
Commit message: Don't treat "localhost.localdomain" as an allowed replacement for localhost, since it isn't.

Diff: diff --git a/scheduler/client.c b/scheduler/client.c
index 42010def..20ccf11a 100644
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -3888,13 +3888,10 @@ valid_host(cupsd_client_t *con)		/* I - Client connection */
     * addresses when accessing CUPS via the loopback interface...
     */
 
     return (!_cups_strcasecmp(con->clientname, "localhost") ||
 	    !_cups_strcasecmp(con->clientname, "localhost.") ||
-#ifdef __linux
-	    !_cups_strcasecmp(con->clientname, "localhost.localdomain") ||
-#endif /* __linux */
             !strcmp(con->clientname, "127.0.0.1") ||
 	    !strcmp(con->clientname, "[::1]"));
   }
 
 #if defined(HAVE_DNSSD) || defined(HAVE_AVAHI)

Vulnerable code: #ifdef __linux
	    !_cups_strcasecmp(con->clientname, "localhost.localdomain") ||
#endif /* __linux */
CVE-2022-4605: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-18T14:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: admin/panels/uploader/admin.uploader.php
Commit date: 2022-12-17 14:39:15 +0100
Commit message: added SVG to forbidden file types in order to prevent possible XSS - see https://github.com/Nguyen-Trung-Kien/CVE/blob/main/CVE-2022-24588/CVE-2022-24588.pdf

Diff: diff --git a/admin/panels/uploader/admin.uploader.php b/admin/panels/uploader/admin.uploader.php
index eeafcaa..8febfb6 100755
--- a/admin/panels/uploader/admin.uploader.php
+++ b/admin/panels/uploader/admin.uploader.php
@@ -93,11 +93,12 @@ class admin_uploader_default extends AdminPanelAction {
 			'fcgi',
 			'fpl',
 			'jsp',
 			'htm',
 			'html',
-			'wml'
+			'wml',
+			'svg'
 		);
 
 		$imgs = array(
 			'.jpg',
 			'.gif',

Vulnerable code: 			'wml'
Fixed code: 			'wml',
			'svg'
CVE-2022-4748: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The name of the patch is 5d5c7f6d8f072d14926fc2c3a97cdd763802f170. It is recommended to apply a patch to fix this issue. The identifier VDB-216861 was assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2022-12-27T09:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: fp-plugins/mediamanager/panels/panel.mediamanager.file.php
Commit date: 2022-12-25 15:00:06 +0100
Commit message: fixes #179, preventing path traversal

Diff: diff --git a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
index 331a32ba..cb33c48b 100644
--- a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
+++ b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
@@ -75,10 +75,12 @@ class admin_uploader_mediamanager extends AdminPanelAction {
 
 	function doItemActions($folder, $mmbaseurl) {
 		/* delete file */
 		if (isset($_GET ['deletefile'])) {
 			list ($type, $name) = explode("-", $_GET ['deletefile'], 2);
+			// prevent path traversal: remove ".." and "/" resp. "\"
+			$name = preg_replace('(\.\.|\/|\\\\)', '', $name);
 			switch ($type) {
 				case 'attachs':
 					$type = ABS_PATH . ATTACHS_DIR;
 					break;
 				case 'images':

Fixed code: 			// prevent path traversal: remove ".." and "/" resp. "\"
			$name = preg_replace('(\.\.|\/|\\\\)', '', $name);
CVE-2022-4755: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgallery-name leads to cross site scripting. The attack may be initiated remotely. The name of the patch is d3f329496536dc99f9707f2f295d571d65a496f5. It is recommended to apply a patch to fix this issue. The identifier VDB-216869 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T10:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: fp-plugins/mediamanager/panels/panel.mediamanager.file.php
Commit date: 2022-12-25 14:32:08 +0100
Commit message: fixes #177, possible XSS in Media Manager plugin

Diff: diff --git a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
index 03e7ba0c..331a32ba 100644
--- a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
+++ b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
@@ -231,11 +231,11 @@ class admin_uploader_mediamanager extends AdminPanelAction {
 		$this->smarty->assign('totalfilescount', $totalfilescount);
 	}
 
 	function onsubmit($data = NULL) {
 		if (isset($_POST ['mm-newgallery'])) {
-			$newgallery = $_POST ['mm-newgallery-name'];
+			$newgallery = strip_tags($_POST ['mm-newgallery-name']);
 			if ($newgallery == "") {
 				$this->smarty->assign('success', -3);
 				return 2;
 			}
 			$newgallery = str_replace("/", "", $newgallery);

Vulnerable code: 			$newgallery = $_POST ['mm-newgallery-name'];
Fixed code: 			$newgallery = strip_tags($_POST ['mm-newgallery-name']);
CVE-2022-4821: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uploader.php of the component XML File Handler/MD File Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 3cc223dec5260e533a84b5cf5780d3a4fbf21241. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217000.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-28T21:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: admin/panels/uploader/admin.uploader.php
Commit date: 2022-12-25 14:42:08 +0100
Commit message: fixes #178, possible XSS via uploaded XML & MD files

Diff: diff --git a/admin/panels/uploader/admin.uploader.php b/admin/panels/uploader/admin.uploader.php
index 8febfb67..3134e2ad 100755
--- a/admin/panels/uploader/admin.uploader.php
+++ b/admin/panels/uploader/admin.uploader.php
@@ -94,11 +94,13 @@ class admin_uploader_default extends AdminPanelAction {
 			'fpl',
 			'jsp',
 			'htm',
 			'html',
 			'wml',
-			'svg'
+			'svg',
+			'xml',
+			'md'
 		);
 
 		$imgs = array(
 			'.jpg',
 			'.gif',

Vulnerable code: 			'svg'
Fixed code: 			'svg',
			'xml',
			'md'
CVE-2023-0947: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2023-02-22T01:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: Other
Files changed: .htaccess
Commit date: 2022-12-18 13:24:38 +0100
Commit message: Added .htaccess to prevent directory browsing.

Diff: diff --git a/.htaccess b/.htaccess
new file mode 100644
index 00000000..45552cb6
--- /dev/null
+++ b/.htaccess
@@ -0,0 +1 @@
+Options -Indexes
\ No newline at end of file

Fixed code: Options -Indexes
CVE-2023-1104: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-01T02:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: admin/panels/uploader/admin.uploader.php
Commit date: 2023-01-08 13:24:41 +0100
Commit message: fixes #188

Diff: diff --git a/admin/panels/uploader/admin.uploader.php b/admin/panels/uploader/admin.uploader.php
index 3134e2ad..e307479f 100755
--- a/admin/panels/uploader/admin.uploader.php
+++ b/admin/panels/uploader/admin.uploader.php
@@ -96,11 +96,12 @@ class admin_uploader_default extends AdminPanelAction {
 			'htm',
 			'html',
 			'wml',
 			'svg',
 			'xml',
-			'md'
+			'md',
+			'pages'
 		);
 
 		$imgs = array(
 			'.jpg',
 			'.gif',

Vulnerable code: 			'md'
Fixed code: 			'md',
			'pages'
CVE-2023-1105: External Control of File Name or Path (CWE-73)
value: External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
CWE description: The product allows user input to control or influence paths or file names that are used in filesystem operations.
CVSS v3 base score: 8.1
Published: 2023-03-01T02:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: fp-plugins/mediamanager/panels/panel.mediamanager.file.php
Commit date: 2022-12-25 15:00:06 +0100
Commit message: fixes #179, preventing path traversal

Diff: diff --git a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
index 331a32ba..cb33c48b 100644
--- a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
+++ b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
@@ -75,10 +75,12 @@ class admin_uploader_mediamanager extends AdminPanelAction {
 
 	function doItemActions($folder, $mmbaseurl) {
 		/* delete file */
 		if (isset($_GET ['deletefile'])) {
 			list ($type, $name) = explode("-", $_GET ['deletefile'], 2);
+			// prevent path traversal: remove ".." and "/" resp. "\"
+			$name = preg_replace('(\.\.|\/|\\\\)', '', $name);
 			switch ($type) {
 				case 'attachs':
 					$type = ABS_PATH . ATTACHS_DIR;
 					break;
 				case 'images':

Fixed code: 			// prevent path traversal: remove ".." and "/" resp. "\"
			$name = preg_replace('(\.\.|\/|\\\\)', '', $name);
CVE-2023-1107: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-02T02:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: fp-plugins/mediamanager/panels/panel.mediamanager.file.php
Commit date: 2022-12-25 14:32:08 +0100
Commit message: fixes #177, possible XSS in Media Manager plugin

Diff: diff --git a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
index 03e7ba0c..331a32ba 100644
--- a/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
+++ b/fp-plugins/mediamanager/panels/panel.mediamanager.file.php
@@ -231,11 +231,11 @@ class admin_uploader_mediamanager extends AdminPanelAction {
 		$this->smarty->assign('totalfilescount', $totalfilescount);
 	}
 
 	function onsubmit($data = NULL) {
 		if (isset($_POST ['mm-newgallery'])) {
-			$newgallery = $_POST ['mm-newgallery-name'];
+			$newgallery = strip_tags($_POST ['mm-newgallery-name']);
 			if ($newgallery == "") {
 				$this->smarty->assign('success', -3);
 				return 2;
 			}
 			$newgallery = str_replace("/", "", $newgallery);

Vulnerable code: 			$newgallery = $_POST ['mm-newgallery-name'];
Fixed code: 			$newgallery = strip_tags($_POST ['mm-newgallery-name']);
CVE-2023-1146: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-02T03:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: admin/panels/config/admin.config.php
Commit date: 2023-01-08 13:11:22 +0100
Commit message: fixes #87, possible XSS in config panel

Diff: diff --git a/admin/panels/config/admin.config.php b/admin/panels/config/admin.config.php
index ab0abbf2..4f90d9c9 100755
--- a/admin/panels/config/admin.config.php
+++ b/admin/panels/config/admin.config.php
@@ -122,18 +122,18 @@ class admin_config_default extends AdminPanelActionValidated {
 			// 'BLOG_ROOT' => $_POST['blog_root'],
 			'www' => $_POST ['www'],
 			'title' => wp_specialchars(stripslashes($_POST ['title'])),
 			'subtitle' => wp_specialchars(stripslashes($_POST ['subtitle'])),
 			'footer' => wp_specialchars(stripslashes($_POST ['blogfooter'])),
-			'author' => $_POST ['author'],
-			'email' => $_POST ['email'],
+			'author' => wp_specialchars($_POST ['author']),
+			'email' => wp_specialchars($_POST ['email']),
 			'startpage' => ($_POST ['startpage'] == ':NULL:') ? null : $_POST ['startpage'],
 			'maxentries' => $_POST ['maxentries'],
 			// 'voting' => $_POST['voting'],
 			'notify' => isset($_POST ['notify']),
-				/* preserve the following */
-				'theme' => $fp_config ['general'] ['theme'],
+			// preserve the following
+			'theme' => $fp_config ['general'] ['theme'],
 			'style' => @$fp_config ['general'] ['style'],
 			'blogid' => $fp_config ['general'] ['blogid'],
 			'charset' => 'utf-8'
 		);
 

Vulnerable code: 			'author' => $_POST ['author'],
			'email' => $_POST ['email'],
				/* preserve the following */
				'theme' => $fp_config ['general'] ['theme'],
Fixed code: 			'author' => wp_specialchars($_POST ['author']),
			'email' => wp_specialchars($_POST ['email']),
			// preserve the following
			'theme' => $fp_config ['general'] ['theme'],
CVE-2023-1147: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-02T03:15Z
Repository: https://github.com/flatpressblog/flatpress
Language: PHP
Files changed: fp-includes/core/core.comment.php
Commit date: 2023-01-08 13:04:12 +0100
Commit message: Fixes #186, possible XSS in comments

Diff: diff --git a/fp-includes/core/core.comment.php b/fp-includes/core/core.comment.php
index a4d0f97d..dcb46a86 100755
--- a/fp-includes/core/core.comment.php
+++ b/fp-includes/core/core.comment.php
@@ -71,16 +71,18 @@ function comment_exists($entryid, $id) {
 
 	return $f2;
 }
 
 function comment_clean(&$arr) {
-	$arr ['name'] = apply_filters('pre_comment_author_name', stripslashes($arr ['name']));
-	if (isset($arr ['email']))
-		$arr ['email'] = apply_filters('pre_comment_author_email', $arr ['email']);
-	if (isset($arr ['url']))
-		$arr ['url'] = apply_filters('pre_comment_author_url', $arr ['url']);
-	$arr ['content'] = apply_filters('pre_comment_content', $arr ['content']);
+	$arr ['name'] = strip_tags(apply_filters('pre_comment_author_name', stripslashes($arr ['name'])));
+	if (isset($arr ['email'])) {
+		$arr ['email'] = strip_tags(apply_filters('pre_comment_author_email', $arr ['email']));
+	}
+	if (isset($arr ['url'])) {
+		$arr ['url'] = strip_tags(apply_filters('pre_comment_author_url', $arr ['url']));
+	}
+	$arr ['content'] = strip_tags(apply_filters('pre_comment_content', $arr ['content']));
 	return $arr;
 }
 
 /**
  * function bdb_save_comment

Vulnerable code: 	$arr ['name'] = apply_filters('pre_comment_author_name', stripslashes($arr ['name']));
	if (isset($arr ['email']))
		$arr ['email'] = apply_filters('pre_comment_author_email', $arr ['email']);
	if (isset($arr ['url']))
		$arr ['url'] = apply_filters('pre_comment_author_url', $arr ['url']);
	$arr ['content'] = apply_filters('pre_comment_content', $arr ['content']);
Fixed code: 	$arr ['name'] = strip_tags(apply_filters('pre_comment_author_name', stripslashes($arr ['name'])));
	if (isset($arr ['email'])) {
		$arr ['email'] = strip_tags(apply_filters('pre_comment_author_email', $arr ['email']));
	}
	if (isset($arr ['url'])) {
		$arr ['url'] = strip_tags(apply_filters('pre_comment_author_url', $arr ['url']));
	}
	$arr ['content'] = strip_tags(apply_filters('pre_comment_content', $arr ['content']));
CVE-2018-25073: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic. This vulnerability affects the function getlog of the file webinterface/bot.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.7 is able to address this issue. The patch is identified as b3a3cd8efe2cd3bd3c5b3b7abf2fe80dbee51b77. It is recommended to upgrade the affected component. VDB-218002 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-11T14:15Z
Repository: https://github.com/Newcomer1989/TSN-Ranksystem
Language: Unknown
Commit date: 2018-04-05 20:47:48 +0200
Commit message: Merge pull request #467 from JVMerkle/xss_pull

Fix reflected XSS in bot.php
CVE-2022-4603: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2022-12-18T11:15Z
Repository: https://github.com/ppp-project/ppp
Language: C
Files changed: pppdump/pppdump.c
Commit date: 2022-08-04 12:23:08 +1000
Commit message: pppdump: Avoid out-of-range access to packet buffer

This fixes a potential vulnerability where data is written to spkt.buf
and rpkt.buf without a check on the array index.  To fix this, we
check the array index (pkt->cnt) before storing the byte or
incrementing the count.  This also means we no longer have a potential
signed integer overflow on the increment of pkt->cnt.

Fortunately, pppdump is not used in the normal process of setting up a
PPP connection, is not installed setuid-root, and is not invoked
automatically in any scenario that I am aware of.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>

Diff: diff --git a/pppdump/pppdump.c b/pppdump/pppdump.c
index 2b815fc..b85a862 100644
--- a/pppdump/pppdump.c
+++ b/pppdump/pppdump.c
@@ -295,10 +295,14 @@ dumpppp(f)
 			q = dir;
 			if (pkt->esc) {
 			    printf("%s aborted packet:\n     ", dir);
 			    q = "    ";
 			}
+			if (pkt->cnt >= sizeof(pkt->buf)) {
+			    printf("%s over-long packet truncated:\n     ", dir);
+			    q = "    ";
+			}
 			nb = pkt->cnt;
 			p = pkt->buf;
 			pkt->cnt = 0;
 			pkt->esc = 0;
 			if (nb <= 2) {
@@ -398,11 +402,12 @@ dumpppp(f)
 		default:
 		    if (pkt->esc) {
 			c ^= 0x20;
 			pkt->esc = 0;
 		    }
-		    pkt->buf[pkt->cnt++] = c;
+		    if (pkt->cnt < sizeof(pkt->buf))
+			pkt->buf[pkt->cnt++] = c;
 		    break;
 		}
 	    }
 	    break;
 	case 3:

Vulnerable code: 		    pkt->buf[pkt->cnt++] = c;
Fixed code: 			if (pkt->cnt >= sizeof(pkt->buf)) {
			    printf("%s over-long packet truncated:\n     ", dir);
			    q = "    ";
			}
		    if (pkt->cnt < sizeof(pkt->buf))
			pkt->buf[pkt->cnt++] = c;
CVE-2021-31245: Improper Authentication (CWE-287)
value: omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which allows remote attackers to guess the password via a timing attack.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 5.9
Published: 2021-05-06T13:15Z
Repository: https://github.com/Ysurac/openmptcprouter-vps-admin
Language: Python
Files changed: omr-admin.py
Commit date: 2021-04-08 17:37:19 +0200
Commit message: Fix timing attacks potential vulnerability

Diff: diff --git a/omr-admin.py b/omr-admin.py
index 802136e..9cf4395 100755
--- a/omr-admin.py
+++ b/omr-admin.py
@@ -774,11 +774,11 @@ with open('/etc/openmptcprouter-vps-admin/omr-admin-config.json') as f:
         LOG.setLevel(logging.DEBUG)
 
 fake_users_db = omr_config_data['users'][0]
 
 def verify_password(plain_password, user_password):
-    if plain_password == user_password:
+    if secrets.compare_digest(plain_password,user_password):
         LOG.debug("password true")
         return True
     return False
 
 def get_password_hash(password):

Vulnerable code:     if plain_password == user_password:
Fixed code:     if secrets.compare_digest(plain_password,user_password):
CVE-2013-4168: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-11-01T20:15Z
Repository: https://github.com/oetiker/SmokePing
Language: Perl
Files changed: lib/Smokeping.pm
Commit date: 2013-03-17 13:11:10 +0100
Commit message: xss fix from Steven Chamberlain

Diff: diff --git a/lib/Smokeping.pm b/lib/Smokeping.pm
index cec130a..080b538 100644
--- a/lib/Smokeping.pm
+++ b/lib/Smokeping.pm
@@ -1026,12 +1026,13 @@ sub smokecol ($) {
     return \@items;
 }
 
 sub parse_datetime($){
     my $in = shift;
-    for ($in){
-	/^(\d+)$/ && do { my $value = $1; $value = time if $value > 2**32; return $value};
+    for ($in){ 
+        $in =~ s/$xssBadRx/_/g;
+        /^(\d+)$/ && do { my $value = $1; $value = time if $value > 2**32; return $value};
         /^\s*(\d{4})-(\d{1,2})-(\d{1,2})(?:\s+(\d{1,2}):(\d{2})(?::(\d{2}))?)?\s*$/  && 
             return POSIX::mktime($6||0,$5||0,$4||0,$3,$2-1,$1-1900,0,0,-1);
         /^now$/ && return time;
         /([ -:a-z0-9]+)/ && return $1;     
     };

Vulnerable code:     for ($in){
	/^(\d+)$/ && do { my $value = $1; $value = time if $value > 2**32; return $value};
Fixed code:     for ($in){ 
        $in =~ s/$xssBadRx/_/g;
        /^(\d+)$/ && do { my $value = $1; $value = time if $value > 2**32; return $value};
CVE-2022-32323: Out-of-bounds Write (CWE-787)
value: AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.3
Published: 2022-07-14T21:15Z
Repository: https://github.com/autotrace/autotrace
Language: Unknown
Commit date: 2022-05-31 20:40:06 +0200
Commit message: Merge pull request #72 from lemenkov/misleading_indentation

Misleading indentation
CVE-2023-45669: Improper Authentication (CWE-287)
value: WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version `0.9.1.RELEASE`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 5.3
Published: 2023-10-16T19:15Z
Repository: https://github.com/webauthn4j/webauthn4j-spring-security
Language: Unknown
Commit date: 2023-10-16 23:32:50 +0900
Commit message: Merge pull request from GHSA-v9hx-v6vf-g36j

Release 0.9.1
CVE-2020-36048: Uncontrolled Resource Consumption (CWE-400)
value: Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2021-01-08T00:15Z
Repository: https://github.com/socketio/engine.io
Language: JavaScript
Files changed: lib/server.js
Commit date: 2020-02-11 07:59:13 +0100
Commit message: feat: decrease the default value of maxHttpBufferSize

This change reduces the default value from 100 mb to a more sane 1 mb.

This helps protect the server against denial of service attacks by
malicious clients sending huge amounts of data.

Diff: diff --git a/lib/server.js b/lib/server.js
index 527c7a0..9b30a4a 100644
--- a/lib/server.js
+++ b/lib/server.js
@@ -24,11 +24,11 @@ class Server extends EventEmitter {
       {
         wsEngine: process.env.EIO_WS_ENGINE || "ws",
         pingTimeout: 5000,
         pingInterval: 25000,
         upgradeTimeout: 10000,
-        maxHttpBufferSize: 10e7,
+        maxHttpBufferSize: 1e6,
         transports: Object.keys(transports),
         allowUpgrades: true,
         perMessageDeflate: {
           threshold: 1024
         },

Vulnerable code:         maxHttpBufferSize: 10e7,
Fixed code:         maxHttpBufferSize: 1e6,
CVE-2022-41940: Uncaught Exception (CWE-248)
value: Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
CWE description: An exception is thrown from a function, but it is not caught.
CVSS v3 base score: 6.5
Published: 2022-11-22T01:15Z
Repository: https://github.com/socketio/engine.io
Language: TypeScript
Files changed: lib/server.ts
Commit date: 2022-11-20 01:55:11 +0100
Commit message: fix: catch errors when destroying invalid upgrades (#658)

Before this change, receiving an HTTP2 upgrade would make the server
crash:

> Error: read ECONNRESET
>    at TCP.onStreamRead (node:internal/stream_base_commons:217:20) {
>  errno: -104,
>  code: 'ECONNRESET',
>  syscall: 'read'
> }

This can be reproduced with Node.js v14.15.3, v16.18.1 and v18.12.1.

Diff: diff --git a/lib/server.ts b/lib/server.ts
index 58371c9..c99f8ef 100644
--- a/lib/server.ts
+++ b/lib/server.ts
@@ -676,10 +676,13 @@ export class Server extends BaseServer {
           // and if no eio thing handles the upgrade
           // then the socket needs to die!
           setTimeout(function() {
             // @ts-ignore
             if (socket.writable && socket.bytesWritten <= 0) {
+              socket.on("error", e => {
+                debug("error while destroying upgrade: %s", e.message);
+              });
               return socket.end();
             }
           }, destroyUpgradeTimeout);
         }
       });

Fixed code:               socket.on("error", e => {
                debug("error while destroying upgrade: %s", e.message);
              });
CVE-2015-7316: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-09-25T17:29Z
Repository: https://github.com/plone/Products.CMFPlone
Language: Unknown
Commit date: 2015-09-10 12:57:08 -0500
Commit message: Merge pull request #914 from plone/isURLInPortal-hotfix

Apply isURLInPortal fix from https://pypi.python.org/pypi/Products.PloneHotfix20150910
CVE-2022-42725: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.5
Published: 2022-10-10T05:15Z
Repository: https://github.com/linuxmint/warpinator
Language: Python
Files changed: src/transfers.py
Commit date: 2022-09-20 12:23:36 -0400
Commit message: transfers: Don't allow a received file to be saved outside of the
transfer folder.

Since relative paths are valid for GFiles, we need to make sure
they resolve as descendants of the incoming transfer folder.

Diff: diff --git a/src/transfers.py b/src/transfers.py
index 0996738..34f4ba2 100644
--- a/src/transfers.py
+++ b/src/transfers.py
@@ -2,18 +2,21 @@
 
 import os
 import logging
 import stat
 import shutil
+import gettext
 
 from gi.repository import GLib, Gio, GObject
 
 import util
 from util import FileType
 import prefs
 import warp_pb2
 
+_ = gettext.gettext
+
 FILE_INFOS = ",".join([
     "standard::size",
     "standard::allocated-size",
     "standard::name",
     "standard::type",
@@ -162,10 +165,11 @@ class FileSender(GObject.Object):
 
 class FileReceiver(GObject.Object):
     def __init__(self, op):
         super(FileReceiver, self).__init__()
         self.save_path = prefs.get_save_path()
+        self.save_path_file = Gio.File.new_for_path(self.save_path)
         self.op = op
         self.preserve_perms = prefs.preserve_permissions() and util.save_folder_is_native_fs()
         self.preserve_timestamp = prefs.preserve_timestamp() and util.save_folder_is_native_fs()
 
         self.current_path = None
@@ -206,10 +210,13 @@ class FileReceiver(GObject.Object):
             self.current_mtime = s.time.mtime
             self.current_mtime_usec = s.time.mtime_usec
 
         if not self.current_gfile:
             self.current_gfile = Gio.File.new_for_path(path)
+            # Check for valid path (GFile resolves paths upon creation).
+            if self.save_path_file.get_relative_path(self.current_gfile) is None:
+                raise Exception(_("Resolved path is not valid: %s -> %s") % (path, self.current_gfile.get_path()))
 
         if s.file_type == FileType.DIRECTORY:
             os.makedirs(path, exist_ok=True)
         elif s.file_type == FileType.SYMBOLIC_LINK:
             make_symbolic_link(self.op, path, s.symlink_target)

Fixed code: import gettext
_ = gettext.gettext

        self.save_path_file = Gio.File.new_for_path(self.save_path)
            # Check for valid path (GFile resolves paths upon creation).
            if self.save_path_file.get_relative_path(self.current_gfile) is None:
                raise Exception(_("Resolved path is not valid: %s -> %s") % (path, self.current_gfile.get_path()))
CVE-2022-42725: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.5
Published: 2022-10-10T05:15Z
Repository: https://github.com/linuxmint/warpinator
Language: Python
Files changed: src/util.py
Commit date: 2022-09-20 15:11:49 -0400
Commit message: transfers: Use g_file_query_exists() instead of g_file_test().

When checking for existing files, g_file_test (and os.path.exists)
both follow symbolic links, whereas g_file_query_exists() notices
the link itself.

In both cases the link (and not the link's target) would have been
overwritten, but now the recipient will know about it.

Diff: diff --git a/src/util.py b/src/util.py
index 1d5274f..ce3fc0f 100644
--- a/src/util.py
+++ b/src/util.py
@@ -261,11 +261,12 @@ def have_free_space(size):
 
 def files_exist(base_names):
     for name in base_names:
         path = os.path.join(prefs.get_save_path(), name)
         logging.debug("(server side) Checking if file or folder %s already exists." % (path,))
-        if GLib.file_test(path, GLib.FileTest.EXISTS):
+        file = Gio.File.new_for_path(path)
+        if file.query_exists(None):
             return True
 
     return False
 
 def check_ml(fid):

Vulnerable code:         if GLib.file_test(path, GLib.FileTest.EXISTS):
Fixed code:         file = Gio.File.new_for_path(path)
        if file.query_exists(None):
CVE-2024-38520: Insufficient Information (NVD-CWE-noinfo)
value: SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it introduces the possibility of the host being used for amplification/reflection traffic generation because it will respond to every packet with two response packets that are larger than the request packet size. These sorts of techniques are used by external actors who generate spoofed source IPs to target a destination on the internet. This vulnerability has been patched in version 5.02.5185.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-26T19:15Z
Repository: https://github.com/SoftEtherVPN/SoftEtherVPN
Language: Unknown
Commit date: 2024-06-22 18:57:28 +0200
Commit message: Merge pull request from GHSA-j35p-p8pj-vqxq

src/Cedar/Proto_IKE.c: ignore packets with no IPSec SA
CVE-2020-5266: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is fixed in 3.1.0
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-04-16T22:15Z
Repository: https://github.com/PrestaShop/ps_linklist
Language: Unknown
Commit date: 2020-04-15 16:16:20 +0200
Commit message: Merge pull request from GHSA-vr7g-vqp5-966j

Store XSS on create / edit page
CVE-2020-5273: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop module ps_linklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-04-16T22:15Z
Repository: https://github.com/PrestaShop/ps_linklist
Language: Unknown
Commit date: 2020-04-15 16:16:34 +0200
Commit message: Merge pull request from GHSA-cx2r-mf6x-55rx

The custom url field must be a valid url
CVE-2014-9096: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2014-11-26T15:59Z
Repository: https://github.com/Pligg/pligg-cms
Language: PHP
Files changed: recover.php
Commit date: 2014-07-30 09:15:22 -0700
Commit message: - Security fix applied to address a vulnerability

Diff: diff --git a/recover.php b/recover.php
index c9fcbef..9efb96b 100644
--- a/recover.php
+++ b/recover.php
@@ -24,12 +24,12 @@ $errorMsg="";
 if($my_pligg_base){
 	if (strpos($_GET['return'],$my_pligg_base)!==0) $_GET['return']=$my_pligg_base . '/';
 	if (strpos($_POST['return'],$my_pligg_base)!==0) $_POST['return']=$my_pligg_base . '/';
 }
 
-$id=$_REQUEST['id'];
-$n=$_REQUEST['n'];
+$id=sanitize($_REQUEST['id'], 3);
+$n=sanitize($_REQUEST['n'], 3);
 $username=base64_decode($id);
 $sql="SELECT * FROM `" . table_users . "` where `user_login` = '".$username."' AND `last_reset_request` = FROM_UNIXTIME('".$n."') AND user_level!='Spammer'";
 		
 $user = $db->get_row($sql);
 

Vulnerable code: $id=$_REQUEST['id'];
$n=$_REQUEST['n'];
Fixed code: $id=sanitize($_REQUEST['id'], 3);
$n=sanitize($_REQUEST['n'], 3);
CVE-2014-9096: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2014-11-26T15:59Z
Repository: https://github.com/Pligg/pligg-cms
Language: PHP
Files changed: recover.php
Commit date: 2014-08-12 09:25:26 -0700
Commit message: - Added another layer of sanitization to the recover password page, as recommended by Dominik

Diff: diff --git a/recover.php b/recover.php
index 9efb96bb..a5c52fbe 100644
--- a/recover.php
+++ b/recover.php
@@ -26,11 +26,13 @@ if($my_pligg_base){
 	if (strpos($_POST['return'],$my_pligg_base)!==0) $_POST['return']=$my_pligg_base . '/';
 }
 
 $id=sanitize($_REQUEST['id'], 3);
 $n=sanitize($_REQUEST['n'], 3);
-$username=base64_decode($id);
+$idTemp=base64_decode($id);
+$username=sanitize($idTemp ,3);
+
 $sql="SELECT * FROM `" . table_users . "` where `user_login` = '".$username."' AND `last_reset_request` = FROM_UNIXTIME('".$n."') AND user_level!='Spammer'";
 		
 $user = $db->get_row($sql);
 
 if($user){

Vulnerable code: $username=base64_decode($id);
Fixed code: $idTemp=base64_decode($id);
$username=sanitize($idTemp ,3);
CVE-2020-24753: Improper Handling of Exceptional Conditions (CWE-755)
value: A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation (CBOR) input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings leads to the use of an attacker-controllable uninitialized stack value. This can be used to modify memory, causing a crash or potentially exploitable heap corruption.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 9.8
Published: 2020-09-17T18:15Z
Repository: https://github.com/objsys/oocborrt
Language: C
Files changed: util/cbor2json.c
Commit date: 2020-08-12 15:26:00 -0400
Commit message: fixed missing return status test error

Diff: diff --git a/util/cbor2json.c b/util/cbor2json.c
index 5b44edf..55a58c3 100644
--- a/util/cbor2json.c
+++ b/util/cbor2json.c
@@ -110,10 +110,11 @@ static int cbor2json (OSCTXT* pCborCtxt, OSCTXT* pJsonCtxt)
       break;
    }
    case OSRTCBOR_UTF8STR: {
       OSUTF8CHAR* utf8str;
       ret = rtCborDecDynUTF8Str (pCborCtxt, ub, (char**)&utf8str);
+      if (0 != ret) return LOG_RTERR (pCborCtxt, ret);
 
       ret = rtJsonEncStringValue (pJsonCtxt, utf8str);
       rtxMemFreePtr (pCborCtxt, utf8str);
       if (0 != ret) return LOG_RTERR (pJsonCtxt, ret);
 

Fixed code:       if (0 != ret) return LOG_RTERR (pCborCtxt, ret);