Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-3756: Out-of-bounds Write (CWE-787)
value: libmysofa is vulnerable to Heap-based Buffer Overflow
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2021-10-29T16:15Z
Repository: https://github.com/hoene/libmysofa
Language: C
Files changed: src/hdf/dataobject.c
Commit date: 2021-10-03 17:50:32 +0200
Commit message: Fix for issue 163

Diff: diff --git a/src/hdf/dataobject.c b/src/hdf/dataobject.c
index 900d72e..77bbc01 100644
--- a/src/hdf/dataobject.c
+++ b/src/hdf/dataobject.c
@@ -498,18 +498,21 @@ static int readOHDRHeaderMessageDataLayout(struct READER *reader,
 
     if (validAddress(reader, data_address)) {
       store = ftell(reader->fhd);
       if (fseek(reader->fhd, data_address, SEEK_SET) < 0)
         return errno; // LCOV_EXCL_LINE
-      if (!data->data) {
-        if (data_size > 0x10000000)
-          return MYSOFA_INVALID_FORMAT;
-        data->data_len = data_size;
-        data->data = calloc(1, data_size);
-        if (!data->data)
-          return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE
+      if (data->data) {
+        free(data->data);
+        data->data = NULL;
       }
+      if (data_size > 0x10000000)
+        return MYSOFA_INVALID_FORMAT;
+      data->data_len = data_size;
+      data->data = calloc(1, data_size);
+      if (!data->data)
+        return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE
+
       err = fread(data->data, 1, data_size, reader->fhd);
       if (err != data_size)
         return MYSOFA_READ_ERROR; // LCOV_EXCL_LINE
       if (fseek(reader->fhd, store, SEEK_SET) < 0)
         return errno; // LCOV_EXCL_LINE

Vulnerable code:       if (!data->data) {
        if (data_size > 0x10000000)
          return MYSOFA_INVALID_FORMAT;
        data->data_len = data_size;
        data->data = calloc(1, data_size);
        if (!data->data)
          return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE
Fixed code:       if (data->data) {
        free(data->data);
        data->data = NULL;
      if (data_size > 0x10000000)
        return MYSOFA_INVALID_FORMAT;
      data->data_len = data_size;
      data->data = calloc(1, data_size);
      if (!data->data)
        return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE
CVE-2023-0810: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-02-13T17:15Z
Repository: https://github.com/btcpayserver/btcpayserver
Language: C#
Files changed: BTCPayServer/Storage/StorageExtensions.cs
Commit date: 2023-02-13 23:04:15 +0900
Commit message: Fix XSS: Stenghten CSP rules on static file uploads (#4629)


Diff: diff --git a/BTCPayServer/Storage/StorageExtensions.cs b/BTCPayServer/Storage/StorageExtensions.cs
index cb91b93c2..be3259fda 100644
--- a/BTCPayServer/Storage/StorageExtensions.cs
+++ b/BTCPayServer/Storage/StorageExtensions.cs
@@ -73,10 +73,10 @@ namespace BTCPayServer.Storage
             {
                 if (context.Context.Request.Query.ContainsKey("download"))
                 {
                     context.Context.Response.Headers["Content-Disposition"] = "attachment";
                 }
-                context.Context.Response.Headers["Content-Security-Policy"] = "script-src 'self'";
+                context.Context.Response.Headers["Content-Security-Policy"] = "script-src ;";
             };
         }
     }
 }

Vulnerable code:                 context.Context.Response.Headers["Content-Security-Policy"] = "script-src 'self'";
Fixed code:                 context.Context.Response.Headers["Content-Security-Policy"] = "script-src ;";
CVE-2020-7762: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: This affects the package jsreport-chrome-pdf before 1.10.0.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2020-11-05T13:15Z
Repository: https://github.com/jsreport/jsreport-chrome-pdf
Language: JavaScript
Files changed: lib/conversion.js
Commit date: 2020-10-30 11:09:42 -0500
Commit message: block file requests

Diff: diff --git a/lib/conversion.js b/lib/conversion.js
index 3a76d3b..747256d 100644
--- a/lib/conversion.js
+++ b/lib/conversion.js
@@ -36,10 +36,16 @@ module.exports = async ({ reporter, getBrowser, htmlUrl, strategy, timeout, req,
 
     if (executionInfo.error) {
       return
     }
 
+    await page.setRequestInterception(true)
+
+    if (executionInfo.error) {
+      return
+    }
+
     page.on('pageerror', (err) => {
       pageLog('warn', `Page error: ${err.message}${err.stack ? ` , stack: ${err.stack}` : ''}`)
     })
 
     page.on('error', (err) => {
@@ -62,10 +68,23 @@ module.exports = async ({ reporter, getBrowser, htmlUrl, strategy, timeout, req,
       if (r.redirectChain().length > 0) {
         detail = ` (redirect from: ${trimUrl(r.redirectChain().slice(-1)[0].url())})`
       }
 
       pageLog('debug', `Page request: ${r.method()} (${r.resourceType()}) ${trimUrl(r.url())}${detail}`)
+
+      const isRelativeToHtmlUrl = r.url().lastIndexOf(htmlUrl, 0) === 0
+
+      if (
+        !isRelativeToHtmlUrl &&
+        // potentially dangerous request to local file
+        r.url().lastIndexOf('file:///', 0) === 0
+      ) {
+        r.abort('accessdenied')
+        return
+      }
+
+      r.continue()
     })
 
     page.on('requestfinished', (r) => {
       let requestDesc = 'finished'
       let status = ''

Fixed code:     await page.setRequestInterception(true)

    if (executionInfo.error) {
      return
    }


      const isRelativeToHtmlUrl = r.url().lastIndexOf(htmlUrl, 0) === 0

      if (
        !isRelativeToHtmlUrl &&
        // potentially dangerous request to local file
        r.url().lastIndexOf('file:///', 0) === 0
      ) {
        r.abort('accessdenied')
        return
      }

      r.continue()
CVE-2021-23484: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2022-01-28T22:15Z
Repository: https://github.com/Mostafa-Samir/zip-local
Language: JavaScript
Files changed: tests/unzip.sync.test.js
Commit date: 2021-12-30 18:05:29 +0200
Commit message: add test for sync unzipping a zip-slip attack file

Diff: diff --git a/tests/unzip.sync.test.js b/tests/unzip.sync.test.js
index 57c06de..501722a 100644
--- a/tests/unzip.sync.test.js
+++ b/tests/unzip.sync.test.js
@@ -25,10 +25,17 @@ describe("Unzipping synchronously", function () {
 
         fs.mkdirSync("./tests/assets/hello-sync-unzip");
         zipper.sync.unzip("./tests/assets/hello.zip").save("./tests/assets/hello-sync-unzip/");
     });
 
+    it("should raise an error when an entry is outside extraction path", function () {
+        fs.mkdirSync("./tests/assets/zip-slip-sync");
+        expect(
+            zipper.sync.unzip("./tests/assets/zip-slip.zip").save("./tests/assets/zip-slip-sync")
+        ).to.throw("Entry is outside the extraction path")
+    });
+
     it("checks if unzipped files on disk contain correct data", function (done) {
 
         fs.readFile("./tests/assets/hello-sync-unzip/hello/says-hello", 'utf8', function (err, data) {
 
             if (err)

Fixed code:     it("should raise an error when an entry is outside extraction path", function () {
        fs.mkdirSync("./tests/assets/zip-slip-sync");
        expect(
            zipper.sync.unzip("./tests/assets/zip-slip.zip").save("./tests/assets/zip-slip-sync")
        ).to.throw("Entry is outside the extraction path")
    });
CVE-2014-4501: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-07-23T14:55Z
Repository: https://github.com/luke-jr/bfgminer
Language: C
Files changed: util.c
Commit date: 2014-06-05 17:16:50 +0000
Commit message: Stratum: extract_sockaddr: Truncate overlong addresses rather than stack overflow

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for finding this!

Diff: diff --git a/util.c b/util.c
index c72773b5..4c8d100a 100644
--- a/util.c
+++ b/util.c
@@ -1000,10 +1000,17 @@ bool extract_sockaddr(struct pool *pool, char *url)
 	} else
 		url_len = strlen(url_begin);
 
 	if (url_len < 1)
 		return false;
+	
+	if (url_len >= sizeof(url_address))
+	{
+		applog(LOG_WARNING, "%s: Truncating overflowed address '%.*s'",
+		       __func__, url_len, url_begin);
+		url_len = sizeof(url_address) - 1;
+	}
 
 	sprintf(url_address, "%.*s", url_len, url_begin);
 
 	if (port_len)
 		snprintf(port, 6, "%.*s", port_len, port_start);

Fixed code: 	
	if (url_len >= sizeof(url_address))
	{
		applog(LOG_WARNING, "%s: Truncating overflowed address '%.*s'",
		       __func__, url_len, url_begin);
		url_len = sizeof(url_address) - 1;
	}
CVE-2014-4502: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-07-23T14:55Z
Repository: https://github.com/luke-jr/bfgminer
Language: C
Files changed: util.c
Commit date: 2014-06-05 17:18:48 +0000
Commit message: Bugfix: initiate_stratum: Ensure extranonce2 size is not negative (which could lead to exploits later as too little memory gets allocated)

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for finding this!

Diff: diff --git a/util.c b/util.c
index 4c8d100a..a9dc017e 100644
--- a/util.c
+++ b/util.c
@@ -1703,11 +1703,12 @@ resend:
 		applog(LOG_INFO, "Failed to get nonce1 in initiate_stratum");
 		free(sessionid);
 		goto out;
 	}
 	n2size = json_integer_value(json_array_get(res_val, 2));
-	if (!n2size) {
+	if (n2size < 1)
+	{
 		applog(LOG_INFO, "Failed to get n2size in initiate_stratum");
 		free(sessionid);
 		free(nonce1);
 		goto out;
 	}

Vulnerable code: 	if (!n2size) {
Fixed code: 	if (n2size < 1)
	{
CVE-2023-0289: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-13T16:15Z
Repository: https://github.com/craigk5n/webcalendar
Language: PHP
Files changed: includes/functions.php, view_entry.php
Commit date: 2023-01-13 09:30:42 -0500
Commit message: Security fix: Location event field XSS
- CWE-79: Cross-site Scripting (XSS) - Stored
- The location field was not being properly escaped when presented in
  a number of views, allowing malicious script to run on the user's
  browser.

Diff: diff --git a/includes/functions.php b/includes/functions.php
index 28e111c5..7c8572ab 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -6218,11 +6218,11 @@ function build_entry_popup ( $popupid, $user, $description, $time,
   $ret .= ( $SUMMARY_LENGTH < 80 && strlen ( $name ) && $details
     ? '<dt>' . htmlspecialchars ( substr ( $name, 0, 40 ) ) . "</dt>\n" : '' )
    . ( strlen ( $time )
     ? '<dt>' . translate ( 'Time' ) . ":</dt>\n<dd>$time</dd>\n" : '' )
    . ( ! empty ( $location ) && $details
-    ? '<dt>' . translate ( 'Location' ) . ":</dt>\n<dd> $location</dd>\n" : '' )
+    ? '<dt>' . translate ( 'Location' ) . ":</dt>\n<dd>" . htmlspecialchars($location) . "</dd>\n" : '' )
    . ( ! empty ( $reminder ) && $details
     ? '<dt>' . translate ( 'Send Reminder' ) . ":</dt>\n<dd> $reminder</dd>\n" : '' );
 
   if ( ! empty ( $partList ) && $details ) {
     $ret .= '<dt>' . translate ( 'Participants' ) . ":</dt>\n";
diff --git a/view_entry.php b/view_entry.php
index 20bc4f4a..e6dd5923 100644
--- a/view_entry.php
+++ b/view_entry.php
@@ -417,12 +417,12 @@ echo ( strstr ( $str, '<' ) && strstr ( $str, '>' )
 echo nl2br ( activate_urls ( htmlspecialchars ( $description ) ) );
 }
 echo '</div><div class="w-100"></div></div>' . "\n";
 
 if ($DISABLE_LOCATION_FIELD != 'Y' && !empty($location)) {
-echo '<div class="row"><div class="col-3">' . translate('Description') . "</div>\n";
-echo '<div class="col-9">'  . $location . "</div>\n";
+echo '<div class="row"><div class="col-3">' . translate('Location') . "</div>\n";
+echo '<div class="col-9">'  . htmlentities($location) . "</div>\n";
 echo '<div class="w-100"></div></div>' . "\n";
 }
 
 if (!empty($url)) {
 echo '<div class="row"><div class="col-3">' . translate('URL') . "</div>\n";

Vulnerable code:     ? '<dt>' . translate ( 'Location' ) . ":</dt>\n<dd> $location</dd>\n" : '' )
echo '<div class="row"><div class="col-3">' . translate('Description') . "</div>\n";
echo '<div class="col-9">'  . $location . "</div>\n";
Fixed code:     ? '<dt>' . translate ( 'Location' ) . ":</dt>\n<dd>" . htmlspecialchars($location) . "</dd>\n" : '' )
echo '<div class="row"><div class="col-3">' . translate('Location') . "</div>\n";
echo '<div class="col-9">'  . htmlentities($location) . "</div>\n";
CVE-2024-1394: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs?. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey? and ctx?. That function uses named return parameters to free pkey? and ctx? if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey? and ctx? will be nil inside the deferred function that should free them.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Published: 2024-03-21T13:00Z
Repository: https://github.com/golang-fips/openssl
Language: Unknown
Commit date: 2024-03-20 17:30:05 +0000
Commit message: Merge pull request from GHSA-78hx-gp6g-7mj6

Fix memory leak in setupEVP and newCipherCtx
CVE-2022-4413: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-12T00:15Z
Repository: https://github.com/nuxt/framework
Language: TypeScript
Files changed: packages/nuxt/src/core/runtime/nitro/renderer.ts
Commit date: 2022-11-03 22:48:29 +0100
Commit message: fix(nuxt): disallow directly rendering error page (#8673)


Diff: diff --git a/packages/nuxt/src/core/runtime/nitro/renderer.ts b/packages/nuxt/src/core/runtime/nitro/renderer.ts
index 5cfe7b4c..6109d6c7 100644
--- a/packages/nuxt/src/core/runtime/nitro/renderer.ts
+++ b/packages/nuxt/src/core/runtime/nitro/renderer.ts
@@ -1,9 +1,9 @@
 import { createRenderer, renderResourceHeaders } from 'vue-bundle-renderer/runtime'
 import type { RenderResponse } from 'nitropack'
 import type { Manifest } from 'vite'
-import { appendHeader, getQuery, writeEarlyHints } from 'h3'
+import { appendHeader, createError, getQuery, writeEarlyHints } from 'h3'
 import devalue from '@nuxt/devalue'
 import { joinURL } from 'ufo'
 import { renderToString as _renderToString } from 'vue/server-renderer'
 import { useRuntimeConfig, useNitroApp, defineRenderHandler, getRouteRules } from '#internal/nitro'
 // eslint-disable-next-line import/no-restricted-paths
@@ -119,10 +119,14 @@ const PRERENDER_NO_SSR_ROUTES = new Set(['/index.html', '/200.html', '/404.html'
 export default defineRenderHandler(async (event) => {
   // Whether we're rendering an error page
   const ssrError = event.req.url?.startsWith('/__nuxt_error')
     ? getQuery(event) as Exclude<NuxtApp['payload']['error'], Error>
     : null
+  if (ssrError && event.req.socket.readyState !== 'readOnly' /* direct request */) {
+    throw createError('Cannot directly render error page!')
+  }
+
   let url = ssrError?.url as string || event.req.url!
 
   // Whether we are rendering payload route
   const isRenderingPayload = PAYLOAD_URL_RE.test(url)
   if (isRenderingPayload) {

Vulnerable code: import { appendHeader, getQuery, writeEarlyHints } from 'h3'
Fixed code: import { appendHeader, createError, getQuery, writeEarlyHints } from 'h3'
  if (ssrError && event.req.socket.readyState !== 'readOnly' /* direct request */) {
    throw createError('Cannot directly render error page!')
  }
CVE-2022-4414: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-12T00:15Z
Repository: https://github.com/nuxt/framework
Language: TypeScript
Files changed: packages/nuxt/src/app/composables/payload.ts
Commit date: 2022-11-03 23:28:13 +0100
Commit message: fix(nuxt): ensure payload url has no protocol (#8675)


Diff: diff --git a/packages/nuxt/src/app/composables/payload.ts b/packages/nuxt/src/app/composables/payload.ts
index 011d6a693..997414895 100644
--- a/packages/nuxt/src/app/composables/payload.ts
+++ b/packages/nuxt/src/app/composables/payload.ts
@@ -1,6 +1,6 @@
-import { parseURL, joinURL } from 'ufo'
+import { joinURL } from 'ufo'
 import { useNuxtApp } from '../nuxt'
 import { useHead, useRuntimeConfig } from '..'
 
 interface LoadPayloadOptions {
   fresh?: boolean
@@ -35,16 +35,19 @@ export function preloadPayload (url: string, opts: LoadPayloadOptions = {}) {
 }
 
 // --- Internal ---
 
 function _getPayloadURL (url: string, opts: LoadPayloadOptions = {}) {
-  const parsed = parseURL(url)
-  if (parsed.search) {
+  const u = new URL(url, 'http://localhost')
+  if (u.search) {
     throw new Error('Payload URL cannot contain search params: ' + url)
   }
+  if (u.host !== 'localhost') {
+    throw new Error('Payload URL cannot contain host: ' + url)
+  }
   const hash = opts.hash || (opts.fresh ? Date.now() : '')
-  return joinURL(useRuntimeConfig().app.baseURL, parsed.pathname, hash ? `_payload.${hash}.js` : '_payload.js')
+  return joinURL(useRuntimeConfig().app.baseURL, u.pathname, hash ? `_payload.${hash}.js` : '_payload.js')
 }
 
 async function _importPayload (payloadURL: string) {
   if (process.server) { return null }
   const res = await import(/* webpackIgnore: true */ /* @vite-ignore */ payloadURL).catch((err) => {

Vulnerable code: import { parseURL, joinURL } from 'ufo'
  const parsed = parseURL(url)
  if (parsed.search) {
  return joinURL(useRuntimeConfig().app.baseURL, parsed.pathname, hash ? `_payload.${hash}.js` : '_payload.js')
Fixed code: import { joinURL } from 'ufo'
  const u = new URL(url, 'http://localhost')
  if (u.search) {
  if (u.host !== 'localhost') {
    throw new Error('Payload URL cannot contain host: ' + url)
  }
  return joinURL(useRuntimeConfig().app.baseURL, u.pathname, hash ? `_payload.${hash}.js` : '_payload.js')
CVE-2019-15695: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 7.2
Published: 2019-12-26T16:15Z
Repository: https://github.com/CendioOssman/tigervnc
Language: Other
Files changed: common/rfb/PixelFormat.cxx, tests/unit/pixelformat.cxx
Commit date: 2019-11-15 12:26:25 +0100
Commit message: Handle pixel formats with odd shift values

Our fast paths assume that each channel fits in to a separate byte.
That means the shift needs to be a multiple of 8. Start actually
checking this so that a client cannot trip us up and possibly cause
incorrect code exection.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

Diff: diff --git a/common/rfb/PixelFormat.cxx b/common/rfb/PixelFormat.cxx
index 789c43eda..1b4ab1ba1 100644
--- a/common/rfb/PixelFormat.cxx
+++ b/common/rfb/PixelFormat.cxx
@@ -204,10 +204,16 @@ bool PixelFormat::is888(void) const
     return false;
   if (greenMax != 255)
     return false;
   if (blueMax != 255)
     return false;
+  if ((redShift & 0x7) != 0)
+    return false;
+  if ((greenShift & 0x7) != 0)
+    return false;
+  if ((blueShift & 0x7) != 0)
+    return false;
 
   return true;
 }
 
 
diff --git a/tests/unit/pixelformat.cxx b/tests/unit/pixelformat.cxx
index cfae2f9d0..2e0c0bbb6 100644
--- a/tests/unit/pixelformat.cxx
+++ b/tests/unit/pixelformat.cxx
@@ -168,10 +168,16 @@ void is888Tests()
 
     /* Colour map */
 
     do888Test(false, 8, 8, false, false, 0, 0, 0, 0, 0, 0);
 
+    /* Odd shifts */
+
+    do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 8, 18);
+    do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 11, 24);
+    do888Test(false, 32, 24, false, true, 255, 255, 255, 4, 16, 24);
+
     printf("\n");
 }
 
 int main(int argc, char** argv)
 {

Fixed code:   if ((redShift & 0x7) != 0)
    return false;
  if ((greenShift & 0x7) != 0)
    return false;
  if ((blueShift & 0x7) != 0)
    return false;
    /* Odd shifts */

    do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 8, 18);
    do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 11, 24);
    do888Test(false, 32, 24, false, true, 255, 255, 255, 4, 16, 24);
CVE-2019-15695: Out-of-bounds Write (CWE-787)
value: TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.2
Published: 2019-12-26T16:15Z
Repository: https://github.com/CendioOssman/tigervnc
Language: Other
Files changed: common/rfb/PixelFormat.cxx, tests/unit/pixelformat.cxx
Commit date: 2019-11-15 12:26:25 +0100
Commit message: Handle pixel formats with odd shift values

Our fast paths assume that each channel fits in to a separate byte.
That means the shift needs to be a multiple of 8. Start actually
checking this so that a client cannot trip us up and possibly cause
incorrect code exection.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

Diff: diff --git a/common/rfb/PixelFormat.cxx b/common/rfb/PixelFormat.cxx
index 789c43eda..1b4ab1ba1 100644
--- a/common/rfb/PixelFormat.cxx
+++ b/common/rfb/PixelFormat.cxx
@@ -204,10 +204,16 @@ bool PixelFormat::is888(void) const
     return false;
   if (greenMax != 255)
     return false;
   if (blueMax != 255)
     return false;
+  if ((redShift & 0x7) != 0)
+    return false;
+  if ((greenShift & 0x7) != 0)
+    return false;
+  if ((blueShift & 0x7) != 0)
+    return false;
 
   return true;
 }
 
 
diff --git a/tests/unit/pixelformat.cxx b/tests/unit/pixelformat.cxx
index cfae2f9d0..2e0c0bbb6 100644
--- a/tests/unit/pixelformat.cxx
+++ b/tests/unit/pixelformat.cxx
@@ -168,10 +168,16 @@ void is888Tests()
 
     /* Colour map */
 
     do888Test(false, 8, 8, false, false, 0, 0, 0, 0, 0, 0);
 
+    /* Odd shifts */
+
+    do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 8, 18);
+    do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 11, 24);
+    do888Test(false, 32, 24, false, true, 255, 255, 255, 4, 16, 24);
+
     printf("\n");
 }
 
 int main(int argc, char** argv)
 {

Fixed code:   if ((redShift & 0x7) != 0)
    return false;
  if ((greenShift & 0x7) != 0)
    return false;
  if ((blueShift & 0x7) != 0)
    return false;
    /* Odd shifts */

    do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 8, 18);
    do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 11, 24);
    do888Test(false, 32, 24, false, true, 255, 255, 255, 4, 16, 24);
CVE-2024-21623: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "`Analysis - SonarCloud`" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and alter the repository using this workflow. Commit db560de0b56476c87a2f967466407939196dd254 contains a fix for this issue.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2024-01-02T21:15Z
Repository: https://github.com/mehah/otclient
Language: YAML
Files changed: .github/workflows/analysis-sonarcloud.yml
Commit date: 2023-12-30 12:37:42 -0300
Commit message: Merge pull request from GHSA-q6gr-wc79-v589


Diff: diff --git a/.github/workflows/analysis-sonarcloud.yml b/.github/workflows/analysis-sonarcloud.yml
index 2dd9dcb8..6ae1659c 100644
--- a/.github/workflows/analysis-sonarcloud.yml
+++ b/.github/workflows/analysis-sonarcloud.yml
@@ -91,18 +91,19 @@ jobs:
       - name: Run PR sonar-scanner
         if: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
           sonar-scanner \
             --define sonar.cfamily.threads="${{ env.NUMBER_OF_PROCESSORS  }}" \
             --define sonar.cfamily.cache.enabled=true \
             --define sonar.cfamily.cache.path="$HOME/.cfamily" \
             --define sonar.cfamily.compile-commands=build/compile_commands.json \
             --define sonar.pullrequest.key=${{ github.event.pull_request.number }} \
-            --define sonar.pullrequest.branch=${{ github.event.pull_request.head.ref }} \
+            --define sonar.pullrequest.branch=$BRANCH \
             --define sonar.pullrequest.base=${{ github.event.pull_request.base_ref }}
 
       - name: Run sonar-scanner
         if: ${{ github.event_name == 'push' }}
         env:

Vulnerable code:             --define sonar.pullrequest.branch=${{ github.event.pull_request.head.ref }} \
Fixed code:           BRANCH: ${{ github.event.pull_request.head.ref }}
            --define sonar.pullrequest.branch=$BRANCH \
CVE-2014-2059: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2014-03-01T00:01Z
Repository: https://github.com/jenkinsci/jenkins
Language: Java
Files changed: core/src/main/java/hudson/cli/CreateJobCommand.java
Commit date: 2014-02-11 14:22:39 -0500
Commit message: [FIXED SECURITY-108] Check job name created via CLI

Diff: diff --git a/core/src/main/java/hudson/cli/CreateJobCommand.java b/core/src/main/java/hudson/cli/CreateJobCommand.java
index db73c30b51..02dd6ae55e 100644
--- a/core/src/main/java/hudson/cli/CreateJobCommand.java
+++ b/core/src/main/java/hudson/cli/CreateJobCommand.java
@@ -70,10 +70,11 @@ public class CreateJobCommand extends CLICommand {
                 throw new IllegalArgumentException("Can't create job from CLI in " + group);
             }
             name = name.substring(i + 1);
         }
 
+        Jenkins.checkGoodName(name);
         ig.createProjectFromXML(name, stdin);
         return 0;
     }
 }
 

Fixed code:         Jenkins.checkGoodName(name);
CVE-2014-2063: Insufficient Information (NVD-CWE-noinfo)
value: Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2014-10-17T15:55Z
Repository: https://github.com/jenkinsci/jenkins
Language: Other
Files changed: core/src/main/resources/lib/layout/layout.jelly
Commit date: 2014-02-11 14:19:04 -0500
Commit message: [FIXED SECURITY-80] Add X-Frame-Options head to prevent clickjacking attacks

Diff: diff --git a/core/src/main/resources/lib/layout/layout.jelly b/core/src/main/resources/lib/layout/layout.jelly
index 5d8aa8d449..c31d4c2a31 100644
--- a/core/src/main/resources/lib/layout/layout.jelly
+++ b/core/src/main/resources/lib/layout/layout.jelly
@@ -54,10 +54,11 @@ THE SOFTWARE.
     </st:attribute>
   </st:documentation>
 <st:header name="Expires" value="0" />
 <st:header name="Cache-Control" value="no-cache,must-revalidate" />
 <st:header name="X-Hudson-Theme" value="default" />
+<st:header name="X-Frame-Options" value="sameorigin" />
 <st:contentType value="text/html;charset=UTF-8" />
 
   <j:new var="h" className="hudson.Functions" /><!-- instead of JSP functions -->
 ${h.initPageVariables(context)}
 ${h.initPageVariables(context)}

Fixed code: <st:header name="X-Frame-Options" value="sameorigin" />
CVE-2014-2064: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2014-10-17T15:55Z
Repository: https://github.com/jenkinsci/jenkins
Language: Java
Files changed: core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
Commit date: 2014-02-11 14:17:36 -0500
Commit message: [FIXED SECURITY-79] Prevent (private security realm) usernames from being guessed.

Diff: diff --git a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
index a6568631dd..de7863ecf5 100644
--- a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
+++ b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
@@ -76,10 +76,12 @@ import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
 import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.MissingResourceException;
+import java.util.ResourceBundle;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
 /**
  * {@link SecurityRealm} that performs authentication by looking up {@link User}.
@@ -171,12 +173,19 @@ public class HudsonPrivateSecurityRealm extends AbstractPasswordBasedSecurityRea
     }
 
     @Override
     protected Details authenticate(String username, String password) throws AuthenticationException {
         Details u = loadUserByUsername(username);
-        if (!u.isPasswordCorrect(password))
-            throw new BadCredentialsException("Failed to login as "+username);
+        if (!u.isPasswordCorrect(password)) {
+            String message;
+            try {
+                message = ResourceBundle.getBundle("org.acegisecurity.messages").getString("AbstractUserDetailsAuthenticationProvider.badCredentials");
+            } catch (MissingResourceException x) {
+                message = "Bad credentials";
+            }
+            throw new BadCredentialsException(message);
+        }
         return u;
     }
 
     /**
      * Show the sign up page with the data from the identity.

Vulnerable code:         if (!u.isPasswordCorrect(password))
            throw new BadCredentialsException("Failed to login as "+username);
Fixed code: import java.util.MissingResourceException;
import java.util.ResourceBundle;
        if (!u.isPasswordCorrect(password)) {
            String message;
            try {
                message = ResourceBundle.getBundle("org.acegisecurity.messages").getString("AbstractUserDetailsAuthenticationProvider.badCredentials");
            } catch (MissingResourceException x) {
                message = "Bad credentials";
            }
            throw new BadCredentialsException(message);
        }
CVE-2014-2066: Improper Authentication (CWE-287)
value: Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Published: 2014-10-17T15:55Z
Repository: https://github.com/jenkinsci/jenkins
Language: Java
Files changed: core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java
Commit date: 2014-02-11 14:08:07 -0500
Commit message: [FIXED SECURITY-75] Invalidate session after login to avoid session fixation

Diff: diff --git a/core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java b/core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java
index 7f282199e8..1819c771f4 100644
--- a/core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java
+++ b/core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java
@@ -83,10 +83,11 @@ public class AuthenticationProcessingFilter2 extends AuthenticationProcessingFil
         // make sure we have a session to store this successful authentication, given that we no longer
         // let HttpSessionContextIntegrationFilter2 to create sessions.
         // HttpSessionContextIntegrationFilter stores the updated SecurityContext object into this session later
         // (either when a redirect is issued, via its HttpResponseWrapper, or when the execution returns to its
         // doFilter method.
+        request.getSession().invalidate();
         request.getSession();
     }
 
     /**
      * Leave the information about login failure.

Fixed code:         request.getSession().invalidate();
CVE-2014-2067: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-03-01T00:01Z
Repository: https://github.com/jenkinsci/jenkins
Language: Java
Files changed: core/src/main/java/hudson/model/Cause.java
Commit date: 2014-02-11 14:08:03 -0500
Commit message: [FIXED SECURITY-74] Apply markup formatter to remote cause note.

Diff: diff --git a/core/src/main/java/hudson/model/Cause.java b/core/src/main/java/hudson/model/Cause.java
index 4ccab03338..52b2eeffb1 100644
--- a/core/src/main/java/hudson/model/Cause.java
+++ b/core/src/main/java/hudson/model/Cause.java
@@ -32,10 +32,11 @@ import hudson.diagnosis.OldDataMonitor;
 import hudson.util.XStream2;
 import jenkins.model.Jenkins;
 import org.kohsuke.stapler.export.Exported;
 import org.kohsuke.stapler.export.ExportedBean;
 import com.thoughtworks.xstream.converters.UnmarshallingContext;
+import java.io.IOException;
 import java.util.HashSet;
 import java.util.Set;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nonnull;
 
@@ -369,14 +370,17 @@ public abstract class Cause {
         }
 
         @Override
         public String getShortDescription() {
             if(note != null) {
-                return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, note);
-            } else {
-                return Messages.Cause_RemoteCause_ShortDescription(addr);
+                try {
+                    return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, Jenkins.getInstance().getMarkupFormatter().translate(note));
+                } catch (IOException x) {
+                    // ignore
+                }
             }
+            return Messages.Cause_RemoteCause_ShortDescription(addr);
         }
 
         @Override
         public boolean equals(Object o) {
             return o instanceof RemoteCause && Arrays.equals(new Object[] {addr, note},

Vulnerable code:                 return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, note);
            } else {
                return Messages.Cause_RemoteCause_ShortDescription(addr);
Fixed code: import java.io.IOException;
                try {
                    return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, Jenkins.getInstance().getMarkupFormatter().translate(note));
                } catch (IOException x) {
                    // ignore
                }
            return Messages.Cause_RemoteCause_ShortDescription(addr);
CVE-2014-2068: Permissions, Privileges, and Access Controls (CWE-264)
value: The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2014-10-17T15:55Z
Repository: https://github.com/jenkinsci/jenkins
Language: Java
Files changed: core/src/main/java/hudson/util/RemotingDiagnostics.java
Commit date: 2014-02-11 14:07:32 -0500
Commit message: [FIXED SECURITY-73] Require RUN_SCRIPTS for /heapDump.

Diff: diff --git a/core/src/main/java/hudson/util/RemotingDiagnostics.java b/core/src/main/java/hudson/util/RemotingDiagnostics.java
index 408c9931f4..8f014bbcf8 100644
--- a/core/src/main/java/hudson/util/RemotingDiagnostics.java
+++ b/core/src/main/java/hudson/util/RemotingDiagnostics.java
@@ -200,11 +200,11 @@ public final class RemotingDiagnostics {
             rsp.sendRedirect("heapdump.hprof");
         }
 
         @WebMethod(name="heapdump.hprof")
         public void doHeapDump(StaplerRequest req, StaplerResponse rsp) throws IOException, InterruptedException {
-            owner.checkPermission(Jenkins.ADMINISTER);
+            owner.checkPermission(Jenkins.RUN_SCRIPTS);
             rsp.setContentType("application/octet-stream");
 
             FilePath dump = obtain();
             try {
                 dump.copyTo(rsp.getCompressedOutputStream(req));

Vulnerable code:             owner.checkPermission(Jenkins.ADMINISTER);
Fixed code:             owner.checkPermission(Jenkins.RUN_SCRIPTS);
CVE-2017-2599: Incorrect Authorization (CWE-863)
value: Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 5.4
Published: 2018-04-11T16:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2017-01-04 10:01:53 -0500
Commit message: Merge pull request #90 from jenkinsci-cert/SECURITY-321

[SECURITY-321] Prevent existing items from being overwritten even if you cannot DISCOVER them
CVE-2017-2600: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 4.3
Published: 2018-05-15T20:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2017-01-03 16:12:23 -0500
Commit message: Merge pull request #82 from jenkinsci-cert/security-343

[SECURITY-343] Restrict API access to NodeMonitor data
CVE-2017-2601: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2018-05-10T13:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2017-01-03 14:46:59 -0500
Commit message: Merge pull request #95 from jenkinsci-cert/SECURITY-353

[SECURITY-353] Persisted XSS in parameter definition names and value descriptions
CVE-2017-2602: Insufficient Information (NVD-CWE-noinfo)
value: jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 4.3
Published: 2018-05-15T21:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2017-01-10 17:26:00 -0500
Commit message: Merge pull request #89 from jenkinsci-cert/SECURITY-358

[SECURITY-358] Restrict access to metadata used by WorkflowRun
CVE-2017-2604: Improper Authentication (CWE-287)
value: In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 4.3
Published: 2018-05-15T21:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2016-12-20 15:16:05 -0500
Commit message: Merge pull request #85 from jenkinsci-cert/security-371-staplerproxy

[SECURITY-371] Secure all administrative monitors
CVE-2017-2606: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 4.3
Published: 2018-05-08T20:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2016-12-20 15:12:04 -0500
Commit message: Merge pull request #86 from jenkinsci-cert/SECURITY-380

[FIX SECURITY-380] Don't optimize permission check in getItems()
CVE-2017-2609: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which the current user does not have access to.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 4.3
Published: 2018-05-22T17:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2017-01-05 16:11:09 -0500
Commit message: Merge pull request #96 from jenkinsci-cert/SECURITY-385

[SECURITY-385] Only suggest visible views in search
CVE-2017-2610: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2018-05-15T21:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2017-01-10 17:21:40 -0500
Commit message: Merge pull request #98 from jenkinsci-cert/SECURITY-388

[SECURITY-388] Escape metacharacters in the search box