Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-10788: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-02-04T21:15Z
Repository: https://github.com/Turistforeningen/node-im-metadata
Language: JavaScript
Files changed: index.js
Commit date: 2020-02-03 22:26:09 +0100
Commit message: fix: check path argument before processing (#10)

hotfix to re mediate command injection
Diff: diff --git a/index.js b/index.js
index d85f5ff..54b8ed6 100644
--- a/index.js
+++ b/index.js
@@ -7,19 +7,22 @@ module.exports = function(path, opts, cb) {
   if (!cb) {
     cb = opts;
     opts = {};
   }
 
-  var cmd = module.exports.cmd(path, opts);
-  opts.timeout = opts.timeout || 5000;
-
-  exec(cmd, opts, function(e, stdout, stderr) {
-    if (e) { return cb(e); }
+  if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(path))) {
+    console.log('Input Validation failed, Suspicious Characters found');
+  } else {
+    var cmd = module.exports.cmd(path, opts);
+    opts.timeout = opts.timeout || 5000;
+    exec(cmd, opts, function(e, stdout, stderr) {
+      if (e) { return cb(e); }
     if (stderr) { return cb(new Error(stderr)); }
 
-    return cb(null, module.exports.parse(path, stdout, opts));
+      return cb(null, module.exports.parse(path, stdout, opts));
   });
+}
 };
 
 module.exports.cmd = function(path, opts) {
   opts = opts || {};
   var format = [

Vulnerable code:   var cmd = module.exports.cmd(path, opts);
  opts.timeout = opts.timeout || 5000;

  exec(cmd, opts, function(e, stdout, stderr) {
    if (e) { return cb(e); }
    return cb(null, module.exports.parse(path, stdout, opts));
Fixed code:   if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(path))) {
    console.log('Input Validation failed, Suspicious Characters found');
  } else {
    var cmd = module.exports.cmd(path, opts);
    opts.timeout = opts.timeout || 5000;
    exec(cmd, opts, function(e, stdout, stderr) {
      if (e) { return cb(e); }
      return cb(null, module.exports.parse(path, stdout, opts));
}
CVE-2020-26222: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2020-11-13T16:15Z
Repository: https://github.com/dependabot/dependabot-core
Language: Unknown
Commit date: 2020-11-05 16:45:57 +0100
Commit message: Merge pull request #2727 from dependabot/v0.125.1-release-notes

v0.125.1
CVE-2022-26049: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability. **Note:** This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.8
Published: 2022-09-11T14:15Z
Repository: https://github.com/diffplug/goomph
Language: Unknown
Commit date: 2022-08-09 15:01:17 -0700
Commit message: [SECURITY] Fix Zip Slip Vulnerability (#198)
CVE-2016-15034: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in Dynacase Webdesk and classified as critical. Affected by this issue is the function freedomrss_search of the file freedomrss_search.php. The manipulation leads to sql injection. Upgrading to version 3.2-20180305 is able to address this issue. The patch is identified as 750a9b35af182950c952faf6ddfdcc50a2b25f8b. It is recommended to upgrade the affected component. VDB-233366 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-07-10T18:15Z
Repository: https://github.com/dynacase-labs/dynacase-webdesk
Language: PHP
Files changed: dynacase-webdesk-ui/Actions/WEBDESK/freedomrss_search.php
Commit date: 2016-06-09 15:56:50 +0200
Commit message: fix(security): Correct SQL injection in freedomrss_search.php (refs #6439)

Diff: diff --git a/dynacase-webdesk-ui/Actions/WEBDESK/freedomrss_search.php b/dynacase-webdesk-ui/Actions/WEBDESK/freedomrss_search.php
index b133128..5f99f6a 100644
--- a/dynacase-webdesk-ui/Actions/WEBDESK/freedomrss_search.php
+++ b/dynacase-webdesk-ui/Actions/WEBDESK/freedomrss_search.php
@@ -14,14 +14,14 @@ function freedomrss_search(Action & $action)
     $str = GetHttpVars("str", "");
     $sys = GetHttpVars("sys", 0);
     $user = GetHttpVars("user", $action->user->id);
     $lim = 10;
     
-    $filter[0] = "(title ~* '" . pg_escape_string($str) . "')";
+    $filter[0] = "(title ~* " . pg_escape_literal($str) . ")";
     $filter[1] = "(gui_isrss = 'yes')";
-    if ($sys == 1) $filter[2] = "(owner = " . pg_escape_string($user) . " or gui_sysrss = 'yes')";
-    else $filter[2] = "(owner = " . pg_escape_string($user) . ")";
+    if ($sys == 1) $filter[2] = "(owner = " . pg_escape_literal($user) . " or gui_sysrss = 'yes')";
+    else $filter[2] = "(owner = " . pg_escape_literal($user) . ")";
     
     $famids = array(
         "SEARCH",
         "DIR"
     );
@@ -65,6 +65,5 @@ function rssGetFamTitle($id)
 {
     $t = getTDoc('', $id);
     if (isset($t["title"])) return $t["title"];
     return "Family $id";
 }
-?>

Vulnerable code:     $filter[0] = "(title ~* '" . pg_escape_string($str) . "')";
    if ($sys == 1) $filter[2] = "(owner = " . pg_escape_string($user) . " or gui_sysrss = 'yes')";
    else $filter[2] = "(owner = " . pg_escape_string($user) . ")";
?>
Fixed code:     $filter[0] = "(title ~* " . pg_escape_literal($str) . ")";
    if ($sys == 1) $filter[2] = "(owner = " . pg_escape_literal($user) . " or gui_sysrss = 'yes')";
    else $filter[2] = "(owner = " . pg_escape_literal($user) . ")";
CVE-2023-28628: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in question doesn't handle the backslash (`\`) character in the username correctly, leading to a wrong output. ex. a payload of `https://example.com\\@google.com` would return that the host is `google.com`, but the correct host should be `example.com`. Given that the library returns the wrong authority this may be abused to bypass host restrictions depending on how the library is used in an application. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-03-27T21:15Z
Repository: https://github.com/lambdaisland/uri
Language: Unknown
Commit date: 2023-03-27 15:41:20 -0400
Commit message: Merge pull request from GHSA-cp4w-6x4w-v2h5

Treat a backslash in the authority section as part of the path
CVE-2014-7205: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Published: 2014-10-08T17:55Z
Repository: https://github.com/hapijs/bassmaster
Language: JavaScript
Files changed: lib/batch.js
Commit date: 2014-09-25 16:06:07 -0700
Commit message: Remove eval statement

Diff: diff --git a/lib/batch.js b/lib/batch.js
index fe98963..e0cbabf 100644
--- a/lib/batch.js
+++ b/lib/batch.js
@@ -144,20 +144,14 @@ internals.batch = function (batchRequest, resultsData, pos, parts, callback) {
 
         if (parts[i].type === 'ref') {
             var ref = resultsData.resultsMap[parts[i].index];
 
             if (ref) {
-                var value = null;
-
-                try {
-                    eval('value = ref.' + parts[i].value + ';');
-                }
-                catch (e) {
-                    error = new Error(e.message);
-                }
+                var value = ref[parts[i].value]||null;
 
                 if (value) {
+
                     if (value.match && value.match(/^[\w:]+$/)) {
                         path += value;
                     }
                     else {
                         error = new Error('Reference value includes illegal characters');

Vulnerable code:                 var value = null;

                try {
                    eval('value = ref.' + parts[i].value + ';');
                }
                catch (e) {
                    error = new Error(e.message);
                }
Fixed code:                 var value = ref[parts[i].value]||null;
CVE-2014-2853: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-04-29T18:55Z
Repository: https://github.com/wikimedia/mediawiki-core
Language: PHP
Files changed: includes/actions/InfoAction.php
Commit date: 2014-04-24 21:52:22 +0200
Commit message: SECURITY: escape sortKey in pageInfo

DEFAULTSORT isn't escaped before being added to the action=info table.

Bug: 63251
Change-Id: I087bfde8cbc69c3507f68ee3cb6e22aba0ffa7db

Diff: diff --git a/includes/actions/InfoAction.php b/includes/actions/InfoAction.php
index 06e36676b3..6b254603d3 100644
--- a/includes/actions/InfoAction.php
+++ b/includes/actions/InfoAction.php
@@ -260,10 +260,11 @@ class InfoAction extends FormlessAction {
 		$sortKey = $title->getCategorySortkey();
 		if ( !empty( $pageProperties['defaultsort'] ) ) {
 			$sortKey = $pageProperties['defaultsort'];
 		}
 
+		$sortKey = htmlspecialchars( $sortKey );
 		$pageInfo['header-basic'][] = array( $this->msg( 'pageinfo-default-sort' ), $sortKey );
 
 		// Page length (in bytes)
 		$pageInfo['header-basic'][] = array(
 			$this->msg( 'pageinfo-length' ), $lang->formatNum( $title->getLength() )

Fixed code: 		$sortKey = htmlspecialchars( $sortKey );
CVE-2024-35232: Insufficient Information (NVD-CWE-noinfo)
value: github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-24T21:15Z
Repository: https://github.com/huandu/facebook
Language: Unknown
Commit date: 2024-05-24 22:03:35 +0800
Commit message: Merge pull request from GHSA-3f65-m234-9mxr

Exclude access_token from error message
CVE-2013-6048: Improper Input Validation (CWE-20)
value: The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service (infinite loop and memory consumption in the munin-html process) via crafted multigraph data.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-12-13T18:55Z
Repository: https://github.com/munin-monitoring/munin
Language: Perl
Files changed: master/lib/Munin/Master/HTMLConfig.pm
Commit date: 2013-10-28 19:33:14 +0100
Commit message: master: avoid an endless loop in HTML generation

Safeguard to avoid any bigger loop than 100 nested levels. It protects against
application bugs in the parsing code.

Thx Christoph Biedl (debian.axhn@manchmal.in-ulm.de) for noticing
and for providing a patch

Closes: C:CVE-2013-6048

Diff: diff --git a/master/lib/Munin/Master/HTMLConfig.pm b/master/lib/Munin/Master/HTMLConfig.pm
index 9a2d185a..1b013d4d 100644
--- a/master/lib/Munin/Master/HTMLConfig.pm
+++ b/master/lib/Munin/Master/HTMLConfig.pm
@@ -174,10 +174,11 @@ sub get_group_tree {
             #TODO: Think of a nicer way to generate relative urls (reference #1)
 			for (my $shrinkpath = $childnode->{'url'}, my $counter = 0;
 			 $shrinkpath;
 			 $shrinkpath =~ s/^[^\/]+\/?//, $counter++)
 	    	{
+                die ("Munin::Master::HTMLConfig ran into an endless loop") if ($counter >= 100);
                 $childnode->{'url' . $counter} = $shrinkpath;
             }
 
             push @{$cattrav->{lc munin_get($child, "graph_category", "other")}}, $childnode;
 
@@ -216,10 +217,11 @@ sub get_group_tree {
         for (
             my $shrinkpath = $obj->{'url'}, my $counter = 0;
             $shrinkpath =~ /\//;
             $shrinkpath =~ s/^[^\/]+\/*//, $counter++
             ) {
+            die ("Munin::Master::HTMLConfig ran into an endless loop") if ($counter >= 100);
             $obj->{'url' . $counter} = $shrinkpath;
         }
         push @$cats, $obj;
     }
 
@@ -315,10 +317,11 @@ sub get_group_tree {
         for (
             my $shrinkpath = $ret->{'url'}, my $counter = 0;
             $shrinkpath =~ /\//;
             $shrinkpath =~ s/^[^\/]+\/*//, $counter++
             ) {
+            die ("Munin::Master::HTMLConfig ran into an endless loop") if ($counter >= 100);
             $ret->{'url' . $counter} = $shrinkpath;
         }
     }
 
     return $ret;

Fixed code:                 die ("Munin::Master::HTMLConfig ran into an endless loop") if ($counter >= 100);
            die ("Munin::Master::HTMLConfig ran into an endless loop") if ($counter >= 100);
            die ("Munin::Master::HTMLConfig ran into an endless loop") if ($counter >= 100);
CVE-2017-1000414: Divide By Zero (CWE-369)
value: ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a division by zero in the JFIF decode handling resulting denial of service.
CWE description: The product divides a value by zero.
CVSS v3 base score: 7.5
Published: 2018-01-25T16:29Z
Repository: https://github.com/ImpulseAdventure/JPEGsnoop
Language: C++
Files changed: JfifDecode.cpp
Commit date: 2017-06-05 23:32:45 -0700
Commit message: Fixed div0 vulnerability in SampFact

Diff: diff --git a/JfifDecode.cpp b/JfifDecode.cpp
index 78955c9..8026496 100644
--- a/JfifDecode.cpp
+++ b/JfifDecode.cpp
@@ -1,7 +1,7 @@
 // JPEGsnoop - JPEG Image Decoder & Analysis Utility
-// Copyright (C) 2015 - Calvin Hass
+// Copyright (C) 2017 - Calvin Hass
 // http://www.impulseadventure.com/photo/jpeg-snoop.html
 //
 //    This program is free software: you can redistribute it and/or modify
 //    it under the terms of the GNU General Public License as published by
 //    the Free Software Foundation, either version 2 of the License, or
@@ -4901,12 +4901,12 @@ unsigned CjfifDecode::DecodeMarker()
 			// NOTE: We protect against bad input here as replication ratios are
 			// determined later that depend on dividing by sampling factor (hence
 			// possibility of div by 0).
 			m_anSofHorzSampFact_Hi[nCompIdent] = (anSofSampFact[nCompIdent] & 0xF0) >> 4;	// Hi, range 1..4
 			m_anSofVertSampFact_Vi[nCompIdent] = (anSofSampFact[nCompIdent] & 0x0F);		// Vi, range 1..4
-			//if (!ValidateValue(m_anSofHorzSampFact_Hi[nCompIdent],1,4,_T("Horizontal Sampling Factor <Hi>"),true,1)) return DECMARK_ERR;
-			//if (!ValidateValue(m_anSofVertSampFact_Vi[nCompIdent],1,4,_T("Vertical Sampling Factor <Vi>"),true,1)) return DECMARK_ERR;
+			if (!ValidateValue(m_anSofHorzSampFact_Hi[nCompIdent],1,4,_T("Horizontal Sampling Factor <Hi>"),true,1)) return DECMARK_ERR;
+			if (!ValidateValue(m_anSofVertSampFact_Vi[nCompIdent],1,4,_T("Vertical Sampling Factor <Vi>"),true,1)) return DECMARK_ERR;
 
 		}
 
 		// Calculate max sampling factors
 		for (unsigned nCompInd=1;((!m_bStateAbort)&&(nCompInd<=m_nSofNumComps_Nf));nCompInd++)

Vulnerable code: // Copyright (C) 2015 - Calvin Hass
			//if (!ValidateValue(m_anSofHorzSampFact_Hi[nCompIdent],1,4,_T("Horizontal Sampling Factor <Hi>"),true,1)) return DECMARK_ERR;
			//if (!ValidateValue(m_anSofVertSampFact_Vi[nCompIdent],1,4,_T("Vertical Sampling Factor <Vi>"),true,1)) return DECMARK_ERR;
Fixed code: // Copyright (C) 2017 - Calvin Hass
			if (!ValidateValue(m_anSofHorzSampFact_Hi[nCompIdent],1,4,_T("Horizontal Sampling Factor <Hi>"),true,1)) return DECMARK_ERR;
			if (!ValidateValue(m_anSofVertSampFact_Vi[nCompIdent],1,4,_T("Vertical Sampling Factor <Vi>"),true,1)) return DECMARK_ERR;
CVE-2018-3719: Improper Input Validation (CWE-20)
value: mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.8
Published: 2018-06-07T02:29Z
Repository: https://github.com/jonschlinkert/mixin-deep
Language: JavaScript
Files changed: index.js
Commit date: 2018-02-07 11:04:06 -0500
Commit message: exclude __proto__

Diff: diff --git a/index.js b/index.js
index 60f7049..909fbef 100644
--- a/index.js
+++ b/index.js
@@ -21,10 +21,14 @@ function mixinDeep(target, objects) {
  * @param  {*} `val`
  * @param  {String} `key`
  */
 
 function copy(val, key) {
+  if (key === '__proto__') {
+    return;
+  }
+
   var obj = this[key];
   if (isObject(val) && isObject(obj)) {
     mixinDeep(obj, val);
   } else {
     this[key] = val;

Fixed code:   if (key === '__proto__') {
    return;
  }
CVE-2023-42456: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting this functionality is a set of session files (timestamps) for each user, stored in `/var/run/sudo-rs/ts`. These files are named according to the username from which the sudo attempt is made (the origin user).

An issue was discovered in versions prior to 0.2.1 where usernames containing the `.` and `/` characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For example we could add a user to the system containing the username `../../../../bin/cp`. When logged in as a user with that name, that user could run `sudo -K` to clear their session record file. The session code then constructs the path to the session file by concatenating the username to the session file storage directory, resulting in a resolved path of `/bin/cp`. The code then clears that file, resulting in the `cp` binary effectively being removed from the system.

An attacker needs to be able to login as a user with a constructed username. Given that such a username is unlikely to exist on an existing system, they will also need to be able to create the users with the constructed usernames.

The issue is patched in version 0.2.1 of sudo-rs. Sudo-rs now uses the uid for the user instead of their username for determining the filename. Note that an upgrade to this version will result in existing session files being ignored and users will be forced to re-authenticate. It also fully eliminates any possibility of path traversal, given that uids are always integer values.

The `sudo -K` and `sudo -k` commands can run, even if a user has no sudo access. As a workaround, make sure that one's system does not contain any users with a specially crafted username. While this is the case and while untrusted users do not have the ability to create arbitrary users on the system, one should not be able to exploit this issue.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.1
Published: 2023-09-21T16:15Z
Repository: https://github.com/memorysafety/sudo-rs
Language: Unknown
Commit date: 2023-09-21 16:23:07 +0200
Commit message: Merge pull request from GHSA-2r3c-m6v7-9354

Use uid instead of username for storing session files
CVE-2023-42456: Relative Path Traversal (CWE-23)
value: Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting this functionality is a set of session files (timestamps) for each user, stored in `/var/run/sudo-rs/ts`. These files are named according to the username from which the sudo attempt is made (the origin user).

An issue was discovered in versions prior to 0.2.1 where usernames containing the `.` and `/` characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For example we could add a user to the system containing the username `../../../../bin/cp`. When logged in as a user with that name, that user could run `sudo -K` to clear their session record file. The session code then constructs the path to the session file by concatenating the username to the session file storage directory, resulting in a resolved path of `/bin/cp`. The code then clears that file, resulting in the `cp` binary effectively being removed from the system.

An attacker needs to be able to login as a user with a constructed username. Given that such a username is unlikely to exist on an existing system, they will also need to be able to create the users with the constructed usernames.

The issue is patched in version 0.2.1 of sudo-rs. Sudo-rs now uses the uid for the user instead of their username for determining the filename. Note that an upgrade to this version will result in existing session files being ignored and users will be forced to re-authenticate. It also fully eliminates any possibility of path traversal, given that uids are always integer values.

The `sudo -K` and `sudo -k` commands can run, even if a user has no sudo access. As a workaround, make sure that one's system does not contain any users with a specially crafted username. While this is the case and while untrusted users do not have the ability to create arbitrary users on the system, one should not be able to exploit this issue.
CWE description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CVSS v3 base score: 8.1
Published: 2023-09-21T16:15Z
Repository: https://github.com/memorysafety/sudo-rs
Language: Unknown
Commit date: 2023-09-21 16:23:07 +0200
Commit message: Merge pull request from GHSA-2r3c-m6v7-9354

Use uid instead of username for storing session files
CVE-2022-4121: NULL Pointer Dereference (CWE-476)
value: In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to a remote denial of service or other potential consequences.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2023-01-17T18:15Z
Repository: https://github.com/dinhvh/libetpan
Language: C
Files changed: src/low-level/imap/mailimap_types.c
Commit date: 2022-12-19 08:16:40 -0800
Commit message: Fixed crash when st_info_list is NULL. Fixes #420. Fixes CVE-2022-4121.

Diff: diff --git a/src/low-level/imap/mailimap_types.c b/src/low-level/imap/mailimap_types.c
index 9923125..79a0cc2 100644
--- a/src/low-level/imap/mailimap_types.c
+++ b/src/low-level/imap/mailimap_types.c
@@ -1387,13 +1387,15 @@ mailimap_mailbox_data_search_free(clist * data_search)
 LIBETPAN_EXPORT
 void
 mailimap_mailbox_data_status_free(struct mailimap_mailbox_data_status * info)
 {
   mailimap_mailbox_free(info->st_mailbox);
-  clist_foreach(info->st_info_list, (clist_func) mailimap_status_info_free,
-		 NULL);
-  clist_free(info->st_info_list);
+  if (info->st_info_list != NULL) {
+    clist_foreach(info->st_info_list, (clist_func) mailimap_status_info_free,
+      NULL);
+    clist_free(info->st_info_list);
+  }
   free(info);
 }
 
 
 static void

Vulnerable code:   clist_foreach(info->st_info_list, (clist_func) mailimap_status_info_free,
		 NULL);
  clist_free(info->st_info_list);
Fixed code:   if (info->st_info_list != NULL) {
    clist_foreach(info->st_info_list, (clist_func) mailimap_status_info_free,
      NULL);
    clist_free(info->st_info_list);
  }
CVE-2018-13863: Insufficient Information (NVD-CWE-noinfo)
value: The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2018-07-10T20:29Z
Repository: https://github.com/mongodb/js-bson
Language: JavaScript
Files changed: lib/bson/decimal128.js
Commit date: 2018-02-26 15:19:50 -0500
Commit message: fix(decimal128): add basic guard against REDOS attacks

This is a naive approach to reducing the efficacy of a REDOS attack
against this module. A refactor of the regular expression or a
custom parser substitute would be ideal, however this solution
suffices as a stopgap until such work is completed.

Many thanks to James Davis who graciously alterted us to the
attack

Diff: diff --git a/lib/bson/decimal128.js b/lib/bson/decimal128.js
index 6cf2433..1dc2f00 100644
--- a/lib/bson/decimal128.js
+++ b/lib/bson/decimal128.js
@@ -233,10 +233,17 @@ Decimal128.fromString = function(string) {
   var index = 0;
 
   // Trim the string
   string = string.trim();
 
+  // Naively prevent against REDOS attacks.
+  // TODO: implementing a custom parsing for this, or refactoring the regex would yield
+  //       further gains.
+  if (string.length >= 7000) {
+    throw new Error('' + string + ' not a valid Decimal128 string');
+  }
+
   // Results
   var stringMatch = string.match(PARSE_STRING_REGEXP);
   var infMatch = string.match(PARSE_INF_REGEXP);
   var nanMatch = string.match(PARSE_NAN_REGEXP);
 

Fixed code:   // Naively prevent against REDOS attacks.
  // TODO: implementing a custom parsing for this, or refactoring the regex would yield
  //       further gains.
  if (string.length >= 7000) {
    throw new Error('' + string + ' not a valid Decimal128 string');
  }
CVE-2020-36629: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is d3055b3e30b40b65d30c5a06d6e053dffa7f35d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-12-25T11:15Z
Repository: https://github.com/SimbCo/httpster
Language: Unknown
Commit date: 2020-11-19 16:20:09 -0800
Commit message: Merge pull request #36 from 418sec/master

Security Fix for Path Traversal - huntr.dev
CVE-2020-15237: Observable Discrepancy (CWE-203)
value: In Shrine before version 3.3.0, when using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater. A possible workaround is provided in the linked advisory.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.9
Published: 2020-10-05T19:15Z
Repository: https://github.com/shrinerb/shrine
Language: Ruby
Files changed: CHANGELOG.md, lib/shrine/plugins/derivation_endpoint.rb
Commit date: 2020-10-04 18:26:39 +0200
Commit message: Securely compare signature in derivation_endpoint

Using regular string comparison when comparing signature has different
performance depending on how much of the string matched, which can make
derivation_endpoint susceptible to timing attacks. We avoid that by
using `Rack::Utils.secure_compare` instead.

Big thanks to @esparta for reporting this.

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2692b7ca..1efd854a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,9 @@
 ## master
 
+* `derivation_endpoint` – Avoid possibility of timing attacks when comparing signatures (@esparta)
+
 * `derivatives` – Avoid downloading the attached file when calling default no-op processor (@janko)
 
 * `derivatives` – Add `:download` processor setting for skipping downloading source file (@jrochkind, @janko)
 
 * `derivatives` – Copy non-file source IO objects into local file before passing them to the processor (@jrochkind)
diff --git a/lib/shrine/plugins/derivation_endpoint.rb b/lib/shrine/plugins/derivation_endpoint.rb
index 13f4a4aa..0770cda2 100644
--- a/lib/shrine/plugins/derivation_endpoint.rb
+++ b/lib/shrine/plugins/derivation_endpoint.rb
@@ -737,11 +737,11 @@ class Shrine
     end
 
     def verify_signature(string, signature)
       if signature.nil?
         fail InvalidSignature, "missing \"signature\" param"
-      elsif signature != generate_signature(string)
+      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
         fail InvalidSignature, "provided signature does not match the calculated signature"
       end
     end
 
     # Uses HMAC-SHA-256 algorithm to generate a signature from the given string

Vulnerable code:       elsif signature != generate_signature(string)
Fixed code: * `derivation_endpoint` – Avoid possibility of timing attacks when comparing signatures (@esparta)

      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
CVE-2020-15237: Observable Timing Discrepancy (CWE-208)
value: In Shrine before version 3.3.0, when using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater. A possible workaround is provided in the linked advisory.
CWE description: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.9
Published: 2020-10-05T19:15Z
Repository: https://github.com/shrinerb/shrine
Language: Ruby
Files changed: CHANGELOG.md, lib/shrine/plugins/derivation_endpoint.rb
Commit date: 2020-10-04 18:26:39 +0200
Commit message: Securely compare signature in derivation_endpoint

Using regular string comparison when comparing signature has different
performance depending on how much of the string matched, which can make
derivation_endpoint susceptible to timing attacks. We avoid that by
using `Rack::Utils.secure_compare` instead.

Big thanks to @esparta for reporting this.

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2692b7ca..1efd854a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,9 @@
 ## master
 
+* `derivation_endpoint` – Avoid possibility of timing attacks when comparing signatures (@esparta)
+
 * `derivatives` – Avoid downloading the attached file when calling default no-op processor (@janko)
 
 * `derivatives` – Add `:download` processor setting for skipping downloading source file (@jrochkind, @janko)
 
 * `derivatives` – Copy non-file source IO objects into local file before passing them to the processor (@jrochkind)
diff --git a/lib/shrine/plugins/derivation_endpoint.rb b/lib/shrine/plugins/derivation_endpoint.rb
index 13f4a4aa..0770cda2 100644
--- a/lib/shrine/plugins/derivation_endpoint.rb
+++ b/lib/shrine/plugins/derivation_endpoint.rb
@@ -737,11 +737,11 @@ class Shrine
     end
 
     def verify_signature(string, signature)
       if signature.nil?
         fail InvalidSignature, "missing \"signature\" param"
-      elsif signature != generate_signature(string)
+      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
         fail InvalidSignature, "provided signature does not match the calculated signature"
       end
     end
 
     # Uses HMAC-SHA-256 algorithm to generate a signature from the given string

Vulnerable code:       elsif signature != generate_signature(string)
Fixed code: * `derivation_endpoint` – Avoid possibility of timing attacks when comparing signatures (@esparta)

      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
CVE-2023-23625: Uncontrolled Resource Consumption (CWE-400)
value: go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.

CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-02-09T21:15Z
Repository: https://github.com/ipfs/go-unixfs
Language: Unknown
Commit date: 2023-02-09 19:58:47 +0100
Commit message: Merge pull request from GHSA-q264-w97q-q778

fix: correctly handle degenerate hamts while reading data
CVE-2018-1000869: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploitable via Rough user, exploiting the vulnerability to access information he/she does not have access to.. This vulnerability appears to have been fixed in 1.4.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2018-12-20T17:29Z
Repository: https://github.com/phpipam/phpipam
Language: PHP
Files changed: app/admin/nat/item-add-submit.php, misc/CHANGELOG
Commit date: 2018-12-04 19:48:37 +0000
Commit message: Bugfix: Possible SQL injection in nat/item-add-submit.php. Fixes #2344

Diff: diff --git a/app/admin/nat/item-add-submit.php b/app/admin/nat/item-add-submit.php
index d95414ac..7e703302 100644
--- a/app/admin/nat/item-add-submit.php
+++ b/app/admin/nat/item-add-submit.php
@@ -89,10 +89,16 @@ if(isset($_POST['object_type']) && isset($_POST['object_id'])) {
     $obj_type = $_POST['object_type'];      // subnets, ipaddresses
     $obj_id   = $_POST['object_id'];        // object identifier
     $nat_id   = $_POST['id'];               // nat id
     $nat_type = $_POST['type'];             // src, dst
 
+    // validate object type
+    if (!in_array($obj_type, ['subnets', 'ipaddresses'])) { $Result->show("danger", _("Invalid object type"), true); }
+
+    // validate object id
+    if (!is_numeric($obj_id)) { $Result->show("danger", _("Invalid object id"), true); }
+
     // validate object
     $item = $Tools->fetch_object ($obj_type, "id", $obj_id);
     if($item!==false) {
         // update
         if($nat_type=="src") {
diff --git a/misc/CHANGELOG b/misc/CHANGELOG
index fa0f856c..1ba61b92 100755
--- a/misc/CHANGELOG
+++ b/misc/CHANGELOG
@@ -49,10 +49,11 @@
     ----------------------------
     + Hide SNMP community (#2197);
     + Hide LDAP/AD/Radius username / password and secret from logs and syslog (#2006);
     + XSS in phpipamredirect cookie (#2338);
     + XSS in print-user.php, CSRF in user-edit.php (#2326);
+    + Possible SQL injection in nat/item-add-submit.php (#2344);
 
 == 1.3.2
 
     Enhancements, changes:
     ----------------------------

Fixed code:     // validate object type
    if (!in_array($obj_type, ['subnets', 'ipaddresses'])) { $Result->show("danger", _("Invalid object type"), true); }

    // validate object id
    if (!is_numeric($obj_id)) { $Result->show("danger", _("Invalid object id"), true); }

    + Possible SQL injection in nat/item-add-submit.php (#2344);
CVE-2023-0676: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-04T13:15Z
Repository: https://github.com/phpipam/phpipam
Language: PHP
Files changed: app/tools/ip-calculator/bw-calculator-result.php, misc/CHANGELOG
Commit date: 2022-11-27 21:30:35 +0000
Commit message: Bugfix: XSS (reflected) in 'bw-calulator-result.php';

Reported by ZenalArifin

Diff: diff --git a/app/tools/ip-calculator/bw-calculator-result.php b/app/tools/ip-calculator/bw-calculator-result.php
index 1e212db35..3445cf08e 100644
--- a/app/tools/ip-calculator/bw-calculator-result.php
+++ b/app/tools/ip-calculator/bw-calculator-result.php
@@ -8,16 +8,16 @@ $Result		= new Result;
 $User		= new User ($Database);
 # verify that user is logged in
 $User->check_user_session();
 
 // process input values
-$tcp   = $_POST['wsize'];
-$delay = $_POST['delay'];
-$fsize = $_POST['fsize'];
+$tcp   = filter_var($_POST['wsize'], FILTER_VALIDATE_INT,   ["options" => ["min_range"=>1024, "max_range"=>65536]]) ?: die(_("Invalid input"));
+$delay = filter_var($_POST['delay'], FILTER_VALIDATE_FLOAT, ["options" => ["min_range"=>0.1,  "max_range"=>1000]])  ?: die(_("Invalid input"));
+$fsize = filter_var($_POST['fsize'], FILTER_VALIDATE_FLOAT, ["options" => ["min_range"=>100,  "max_range"=>4096]])  ?: die(_("Invalid input"));
 
 // get mbps values from config
-$mbps = round($tcp/($delay/1000)/(1024*1024),2);
+$mbps = round($tcp/($delay/1000)/(1024*1024), 4);
 
 // Calculate transfer time
 $time = round(($fsize / $mbps), 2);
 
 // set network type
diff --git a/misc/CHANGELOG b/misc/CHANGELOG
index a0463d880..c8e9c3114 100755
--- a/misc/CHANGELOG
+++ b/misc/CHANGELOG
@@ -2,10 +2,14 @@
 
     Enhancements, changes:
     ----------------------------
     + php8.1 compatibility (php8.x support is work-in-progress);
 
+    Security Fixes:
+    ----------------------------
+    + XSS (reflected) in 'bw-calulator-result.php';
+
 == 1.5.0
 
     New features:
     ------------
     + Mark subnet as isPool to allocate network and broadcast addresses;

Vulnerable code: $tcp   = $_POST['wsize'];
$delay = $_POST['delay'];
$fsize = $_POST['fsize'];
$mbps = round($tcp/($delay/1000)/(1024*1024),2);
Fixed code: $tcp   = filter_var($_POST['wsize'], FILTER_VALIDATE_INT,   ["options" => ["min_range"=>1024, "max_range"=>65536]]) ?: die(_("Invalid input"));
$delay = filter_var($_POST['delay'], FILTER_VALIDATE_FLOAT, ["options" => ["min_range"=>0.1,  "max_range"=>1000]])  ?: die(_("Invalid input"));
$fsize = filter_var($_POST['fsize'], FILTER_VALIDATE_FLOAT, ["options" => ["min_range"=>100,  "max_range"=>4096]])  ?: die(_("Invalid input"));
$mbps = round($tcp/($delay/1000)/(1024*1024), 4);
    Security Fixes:
    ----------------------------
    + XSS (reflected) in 'bw-calulator-result.php';
CVE-2023-0678: Missing Authorization (CWE-862)
value: Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.3
Published: 2023-02-04T13:15Z
Repository: https://github.com/phpipam/phpipam
Language: PHP
Files changed: functions/scripts/find_full_subnets.php, misc/CHANGELOG
Commit date: 2023-02-03 21:19:38 +0000
Commit message: Bugfix: Restrict find_full_subnets.php to CLI

find_full_subnets.php does not verify if the user is authorized to access the data, and if the script was started from a command line.

Reported by ovprophet

Diff: diff --git a/functions/scripts/find_full_subnets.php b/functions/scripts/find_full_subnets.php
index 8756ea895..79c411167 100755
--- a/functions/scripts/find_full_subnets.php
+++ b/functions/scripts/find_full_subnets.php
@@ -1,7 +1,10 @@
 <?php
 
+# script can only be run from cli
+if(php_sapi_name()!="cli") 						{ die("This script can only be run from cli!"); }
+
 # include required scripts
 require_once( dirname(__FILE__) . '/../functions.php' );
 
 # limit
 $limit = 80;    // 80 percent threshold
@@ -38,6 +41,5 @@ foreach ($all_subnets as $k=>$s) {
 # any fount
 if (isset($out)) {
     // do something with output
     print_r($out);
 }
-?>
\ No newline at end of file
diff --git a/misc/CHANGELOG b/misc/CHANGELOG
index c8e9c3114..8be21e5c2 100755
--- a/misc/CHANGELOG
+++ b/misc/CHANGELOG
@@ -5,10 +5,11 @@
     + php8.1 compatibility (php8.x support is work-in-progress);
 
     Security Fixes:
     ----------------------------
     + XSS (reflected) in 'bw-calulator-result.php';
+    + Restrict find_full_subnets.php to CLI;
 
 == 1.5.0
 
     New features:
     ------------

Vulnerable code: ?>
Fixed code: # script can only be run from cli
if(php_sapi_name()!="cli") 						{ die("This script can only be run from cli!"); }

    + Restrict find_full_subnets.php to CLI;
CVE-2021-23592: Deserialization of Untrusted Data (CWE-502)
value: The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2022-05-06T20:15Z
Repository: https://github.com/top-think/framework
Language: PHP
Files changed: src/think/cache/Driver.php
Commit date: 2022-01-07 12:09:13 +0800
Commit message: 改进缓存驱动unserialize方法参数类型限制

Diff: diff --git a/src/think/cache/Driver.php b/src/think/cache/Driver.php
index 5813c7b3..37ffbc9e 100644
--- a/src/think/cache/Driver.php
+++ b/src/think/cache/Driver.php
@@ -247,11 +247,11 @@ abstract class Driver implements CacheInterface, CacheHandlerInterface
      * 反序列化数据
      * @access protected
      * @param string $data 缓存数据
      * @return mixed
      */
-    protected function unserialize(string $data)
+    protected function unserialize($data)
     {
         if (is_numeric($data)) {
             return $data;
         }
 

Vulnerable code:     protected function unserialize(string $data)
Fixed code:     protected function unserialize($data)