Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-28849: Insufficient Information (NVD-CWE-noinfo)
value: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-14T17:15Z
Repository: https://github.com/follow-redirects/follow-redirects
Language: JavaScript
Files changed: index.js, test/test.js
Commit date: 2024-03-14 17:36:10 +0100
Commit message: Drop Proxy-Authorization across hosts.

Diff: diff --git a/index.js b/index.js
index f58b933..c649cab 100644
--- a/index.js
+++ b/index.js
@@ -459,11 +459,11 @@ RedirectableRequest.prototype._processResponse = function (response) {
   // or to a different domain that is not a superdomain
   if (redirectUrl.protocol !== currentUrlParts.protocol &&
      redirectUrl.protocol !== "https:" ||
      redirectUrl.host !== currentHost &&
      !isSubdomain(redirectUrl.host, currentHost)) {
-    removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);
+    removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
   }
 
   // Evaluate the beforeRedirect callback
   if (isFunction(beforeRedirect)) {
     var responseDetails = {
diff --git a/test/test.js b/test/test.js
index 97e9653..8413192 100644
--- a/test/test.js
+++ b/test/test.js
@@ -1527,10 +1527,11 @@ describe("follow-redirects", function () {
     });
   });
 
   [
     "Authorization",
+    "Proxy-Authorization",
     "Cookie",
   ].forEach(function (header) {
     describe("when the client passes an header named " + header, function () {
       it("ignores it when null", function () {
         app.get("/a", redirectsTo(302, "http://localhost:3600/b"));

Vulnerable code:     removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);
Fixed code:     removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
    "Proxy-Authorization",
CVE-2016-6254: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.1
Published: 2016-08-19T21:59Z
Repository: https://github.com/collectd/collectd
Language: C
Files changed: src/network.c
Commit date: 2016-07-21 07:47:37 +0200
Commit message: network plugin: Fix heap overflow in parse_packet().

Emilien Gaspar has identified a heap overflow in parse_packet(), the
function used by the network plugin to parse incoming network packets.

This is a vulnerability in collectd, though the scope is not clear at
this point. At the very least specially crafted network packets can be
used to crash the daemon. We can't rule out a potential remote code
execution though.

Fixes: CVE-2016-6254

Diff: diff --git a/src/network.c b/src/network.c
index 0ee6ed0b..5c7761d3 100644
--- a/src/network.c
+++ b/src/network.c
@@ -1433,10 +1433,11 @@ static int parse_packet (sockent_t *se, /* {{{ */
 				INFO ("network plugin: Unencrypted packet or "
 						"part has been ignored.");
 				printed_ignore_warning = 1;
 			}
 			buffer = ((char *) buffer) + pkg_length;
+			buffer_size -= (size_t) pkg_length;
 			continue;
 		}
 #endif /* HAVE_LIBGCRYPT */
 		else if (pkg_type == TYPE_SIGN_SHA256)
 		{
@@ -1460,10 +1461,11 @@ static int parse_packet (sockent_t *se, /* {{{ */
 				INFO ("network plugin: Unsigned packet or "
 						"part has been ignored.");
 				printed_ignore_warning = 1;
 			}
 			buffer = ((char *) buffer) + pkg_length;
+			buffer_size -= (size_t) pkg_length;
 			continue;
 		}
 #endif /* HAVE_LIBGCRYPT */
 		else if (pkg_type == TYPE_VALUES)
 		{
@@ -1601,10 +1603,11 @@ static int parse_packet (sockent_t *se, /* {{{ */
 		else
 		{
 			DEBUG ("network plugin: parse_packet: Unknown part"
 					" type: 0x%04hx", pkg_type);
 			buffer = ((char *) buffer) + pkg_length;
+			buffer_size -= (size_t) pkg_length;
 		}
 	} /* while (buffer_size > sizeof (part_header_t)) */
 
 	if (status == 0 && buffer_size > 0)
 		WARNING ("network plugin: parse_packet: Received truncated "

Fixed code: 			buffer_size -= (size_t) pkg_length;
			buffer_size -= (size_t) pkg_length;
			buffer_size -= (size_t) pkg_length;
CVE-2017-16820: Double Free (CWE-415)
value: The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash (or potentially have other impact).
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 9.8
Published: 2017-11-14T21:29Z
Repository: https://github.com/collectd/collectd
Language: C
Files changed: src/snmp.c
Commit date: 2017-09-27 08:15:35 +0200
Commit message: snmp plugin: Fix double free of request PDU

snmp_sess_synch_response() always frees request PDU, in both case of request
error and success. If error condition occurs inside of `while (status == 0)`
loop, double free of `req` happens.

Issue: #2291
Signed-off-by: Florian Forster <octo@collectd.org>

Diff: diff --git a/src/snmp.c b/src/snmp.c
index 287f44b4e..6e26ad59d 100644
--- a/src/snmp.c
+++ b/src/snmp.c
@@ -1355,15 +1355,17 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
     }
 
     if (oid_list_todo_num == 0) {
       /* The request is still empty - so we are finished */
       DEBUG("snmp plugin: all variables have left their subtree");
+      snmp_free_pdu(req);
       status = 0;
       break;
     }
 
     res = NULL;
+    /* snmp_sess_synch_response always frees our req PDU */
     status = snmp_sess_synch_response(host->sess_handle, req, &res);
     if ((status != STAT_SUCCESS) || (res == NULL)) {
       char *errstr = NULL;
 
       snmp_sess_error(host->sess_handle, NULL, NULL, &errstr);
@@ -1374,12 +1376,10 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
 
       if (res != NULL)
         snmp_free_pdu(res);
       res = NULL;
 
-      /* snmp_synch_response already freed our PDU */
-      req = NULL;
       sfree(errstr);
       csnmp_host_close_session(host);
 
       status = -1;
       break;
@@ -1490,13 +1490,10 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
 
   if (res != NULL)
     snmp_free_pdu(res);
   res = NULL;
 
-  if (req != NULL)
-    snmp_free_pdu(req);
-  req = NULL;
 
   if (status == 0)
     csnmp_dispatch_table(host, data, instance_list_head, value_list_head);
 
   /* Free all allocated variables here */

Vulnerable code:       /* snmp_synch_response already freed our PDU */
      req = NULL;
  if (req != NULL)
    snmp_free_pdu(req);
  req = NULL;
Fixed code:       snmp_free_pdu(req);
    /* snmp_sess_synch_response always frees our req PDU */
CVE-2013-6441: Permissions, Privileges, and Access Controls (CWE-264)
value: The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/init, which allows local users to gain privileges by modifying the init file.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2014-02-14T15:55Z
Repository: https://github.com/lxc/lxc
Language: Other
Files changed: templates/lxc-sshd.in
Commit date: 2013-12-19 12:17:39 +0100
Commit message: sshd: Don't bind-mount /sbin/init read-write

lxc-sshd was mounting itself (the template script) as /sbin/init in the
container using a writable bind-mount.

This shouldn't be needed and could lead to quite a few problems should
one of those containers overwrite /sbin/init for some reason.

Instead simply move to a read-only bind-mount which should prevent any
accidental dammage.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Diff: diff --git a/templates/lxc-sshd.in b/templates/lxc-sshd.in
index b8df78f..bbbea62 100644
--- a/templates/lxc-sshd.in
+++ b/templates/lxc-sshd.in
@@ -126,11 +126,11 @@ lxc.mount.entry = /dev dev none ro,bind 0 0
 lxc.mount.entry = /lib lib none ro,bind 0 0
 lxc.mount.entry = /bin bin none ro,bind 0 0
 lxc.mount.entry = /usr usr none ro,bind 0 0
 lxc.mount.entry = /sbin sbin none ro,bind 0 0
 lxc.mount.entry = tmpfs var/run/sshd tmpfs mode=0644 0 0
-lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none bind 0 0
+lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none ro,bind 0 0
 lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
 lxc.mount.entry = sysfs sys sysfs ro 0 0
 lxc.mount.entry = /etc/init.d etc/init.d none ro,bind 0 0
 EOF
 

Vulnerable code: lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none bind 0 0
Fixed code: lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none ro,bind 0 0
CVE-2015-8011: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2020-01-28T19:15Z
Repository: https://github.com/vincentbernat/lldpd
Language: C
Files changed: src/daemon/protocols/lldp.c
Commit date: 2015-10-04 01:53:14 +0200
Commit message: lldp: fix a buffer overflow when handling management address TLV

When a remote device was advertising a too large management address
while still respecting TLV boundaries, lldpd would crash due to a buffer
overflow. However, the buffer being a static one, this buffer overflow
is not exploitable if hardening was not disabled. This bug exists since
version 0.5.6.

Diff: diff --git a/src/daemon/protocols/lldp.c b/src/daemon/protocols/lldp.c
index b78e3a0..431b22f 100644
--- a/src/daemon/protocols/lldp.c
+++ b/src/daemon/protocols/lldp.c
@@ -724,19 +724,24 @@ lldp_decode(struct lldpd *cfg, char *frame, int s,
 			chassis->c_cap_enabled = PEEK_UINT16;
 			break;
 		case LLDP_TLV_MGMT_ADDR:
 			CHECK_TLV_SIZE(1, "Management address");
 			addr_str_length = PEEK_UINT8;
+			if (addr_str_length > sizeof(addr_str_buffer)) {
+				log_warnx("lldp", "too large management address on %s",
+				    hardware->h_ifname);
+				goto malformed;
+			}
 			CHECK_TLV_SIZE(1 + addr_str_length, "Management address");
 			PEEK_BYTES(addr_str_buffer, addr_str_length);
 			addr_length = addr_str_length - 1;
 			addr_family = addr_str_buffer[0];
 			addr_ptr = &addr_str_buffer[1];
 			CHECK_TLV_SIZE(1 + addr_str_length + 5, "Management address");
 			iface_subtype = PEEK_UINT8;
 			iface_number = PEEK_UINT32;
-			
+
 			af = lldpd_af_from_lldp_proto(addr_family);
 			if (af == LLDPD_AF_UNSPEC)
 				break;
 			if (iface_subtype == LLDP_MGMT_IFACE_IFINDEX)
 				iface = iface_number;
@@ -750,11 +755,11 @@ lldp_decode(struct lldpd *cfg, char *frame, int s,
 						goto malformed;
 			}
 			TAILQ_INSERT_TAIL(&chassis->c_mgmt, mgmt, m_entries);
 			break;
 		case LLDP_TLV_ORG:
-			CHECK_TLV_SIZE(4, "Organisational");
+			CHECK_TLV_SIZE(1 + (int)sizeof(orgid), "Organisational");
 			PEEK_BYTES(orgid, sizeof(orgid));
 			tlv_subtype = PEEK_UINT8;
 			if (memcmp(dot1, orgid, sizeof(orgid)) == 0) {
 #ifndef ENABLE_DOT1
 				hardware->h_rx_unrecognized_cnt++;

Vulnerable code: 			
			CHECK_TLV_SIZE(4, "Organisational");
Fixed code: 			if (addr_str_length > sizeof(addr_str_buffer)) {
				log_warnx("lldp", "too large management address on %s",
				    hardware->h_ifname);
				goto malformed;
			}

			CHECK_TLV_SIZE(1 + (int)sizeof(orgid), "Organisational");
CVE-2018-25052: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function _load_sessionid of the file lib/Catalyst/Plugin/Session.pm of the component Session ID Handler. The manipulation of the argument sid leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.41 is able to address this issue. The name of the patch is 88d1b599e1163761c9bd53bec53ba078f13e09d4. It is recommended to upgrade the affected component. VDB-216958 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-28T12:15Z
Repository: https://github.com/perl-catalyst/Catalyst-Plugin-Session
Language: Perl
Files changed: lib/Catalyst/Plugin/Session.pm
Commit date: 2018-12-05 20:20:44 -0600
Commit message: Session: encode HTML entities in error

Without this, it's possible to self-XSS by trying to set a session id to
something like `</script><svg/onload='alert("xss")'>`.

Diff: diff --git a/lib/Catalyst/Plugin/Session.pm b/lib/Catalyst/Plugin/Session.pm
index d6a6b9a..0a2e5ef 100644
--- a/lib/Catalyst/Plugin/Session.pm
+++ b/lib/Catalyst/Plugin/Session.pm
@@ -7,10 +7,11 @@ with 'MooseX::Emulate::Class::Accessor::Fast';
 use MRO::Compat;
 use Catalyst::Exception ();
 use Digest              ();
 use overload            ();
 use Object::Signature   ();
+use HTML::Entities      ();
 use Carp;
 use List::Util qw/ max /;
 
 use namespace::clean -except => 'meta';
 
@@ -478,10 +479,11 @@ sub _load_sessionid {
         if ( $c->validate_session_id($sid) ) {
             # temporarily set the inner key, so that validation will work
             $c->_sessionid($sid);
             return $sid;
         } else {
+            $sid = HTML::Entities::encode_entities($sid);
             my $err = "Tried to set invalid session ID '$sid'";
             $c->log->error($err);
             Catalyst::Exception->throw($err);
         }
     }

Fixed code: use HTML::Entities      ();
            $sid = HTML::Entities::encode_entities($sid);
CVE-2011-3371: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) form_sent, (3) csrf_token, (4) req_confirm, or (5) delete parameter to delete.php, the (6) id, (7) form_sent, (8) csrf_token, (9) req_message, or (10) submit parameter to edit.php, the (11) action, (12) form_sent, (13) csrf_token, (14) req_email, or (15) request_pass parameter to login.php, the (16) email, (17) form_sent, (18) redirect_url, (19) csrf_token, (20) req_subject, (21) req_message, or (22) submit parameter to misc.php, the (23) action, (24) id, (25) form_sent, (26) csrf_token, (27) req_old_password, (28) req_new_password1, (29) req_new_password2, or (30) update parameter to profile.php, or the (31) action, (32) form_sent, (33) csrf_token, (34) req_username, (35) req_password1, (36) req_password2, (37) req_email1, (38) timezone, or (39) register parameter to register.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2011-10-02T20:55Z
Repository: https://github.com/punbb/punbb
Language: PHP
Files changed: include/functions.php
Commit date: 2011-09-18 10:10:01 +0700
Commit message: Fix XSS vulnerabilities described on http://seclists.org/fulldisclosure/2011/Sep/158

Diff: diff --git a/include/functions.php b/include/functions.php
index 703d640..ca9bf20 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -1,10 +1,10 @@
 <?php
 /**
  * Loads common functions used throughout the site.
  *
- * @copyright (C) 2008-2009 PunBB, partially based on code (C) 2008-2009 FluxBB.org
+ * @copyright (C) 2008-2011 PunBB, partially based on code (C) 2008-2009 FluxBB.org
  * @license http://www.gnu.org/licenses/gpl.html GPL version 2 or higher
  * @package PunBB
  */
 
 //
@@ -2670,11 +2670,11 @@ function csrf_confirm_form()
 	</div>
 	<div class="main-content main-frm">
 		<div class="ct-box info-box">
 			<p><?php echo $lang_common['CSRF token mismatch'] ?></p>
 		</div>
-		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $forum_page['form_action'] ?>">
+		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo forum_htmlencode($forum_page['form_action']) ?>">
 			<div class="hidden">
 				<?php echo implode("\n\t\t\t\t", $forum_page['hidden_fields'])."\n" ?>
 			</div>
 			<div class="frm-buttons">
 				<span class="submit"><input type="submit" value="<?php echo $lang_common['Confirm'] ?>" /></span>

Vulnerable code:  * @copyright (C) 2008-2009 PunBB, partially based on code (C) 2008-2009 FluxBB.org
		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $forum_page['form_action'] ?>">
Fixed code:  * @copyright (C) 2008-2011 PunBB, partially based on code (C) 2008-2009 FluxBB.org
		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo forum_htmlencode($forum_page['form_action']) ?>">
CVE-2019-15532: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-08-26T12:15Z
Repository: https://github.com/gchq/CyberChef
Language: Other
Files changed: src/core/operations/TextEncodingBruteForce.mjs
Commit date: 2019-04-14 22:00:17 +0100
Commit message: Fixed XSS in 'Text Encoding Brute Force. Closes #539

Diff: diff --git a/src/core/operations/TextEncodingBruteForce.mjs b/src/core/operations/TextEncodingBruteForce.mjs
index ee5f70d..169e6ad 100644
--- a/src/core/operations/TextEncodingBruteForce.mjs
+++ b/src/core/operations/TextEncodingBruteForce.mjs
@@ -77,11 +77,11 @@ class TextEncodingBruteForce extends Operation {
      */
     present(encodings) {
         let table = "<table class='table table-hover table-sm table-bordered table-nonfluid'><tr><th>Encoding</th><th>Value</th></tr>";
 
         for (const enc in encodings) {
-            const value = Utils.printable(encodings[enc], true);
+            const value = Utils.escapeHtml(Utils.printable(encodings[enc], true));
             table += `<tr><td>${enc}</td><td>${value}</td></tr>`;
         }
 
         table += "<table>";
         return table;

Vulnerable code:             const value = Utils.printable(encodings[enc], true);
Fixed code:             const value = Utils.escapeHtml(Utils.printable(encodings[enc], true));
CVE-2024-28110: Insufficient Information (NVD-CWE-noinfo)
value: Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact. Version 2.15.2 patches this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-06T22:15Z
Repository: https://github.com/cloudevents/sdk-go
Language: Unknown
Commit date: 2024-03-06 09:02:25 -0500
Commit message: Merge pull request from GHSA-5pf6-2qwx-pxm2

Avoid modifying the DefaultClient's Transport
CVE-2021-29136: Improper Input Validation (CWE-20)
value: Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.5
Published: 2021-04-06T16:15Z
Repository: https://github.com/opencontainers/umoci
Language: Go
Files changed: oci/layer/tar_extract.go
Commit date: 2021-04-05 21:57:26 +1000
Commit message: layer: don't permit / type to be changed on extraction

If users can change the type of / to a symlink, they can cause umoci to
overwrite host files. This is obviously bad, and is not caught by the
rest of our directory escape detection code because the root itself has
been changed to a different directory.

Fixes: CVE-2021-29136
Reported-by: Robin Peraglie <robin@cure53.de>
Tested-by: Daniel Dao <dqminh89@gmail.com>
Reviewed-by: Tycho Andersen <tycho@tycho.pizza>
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

Diff: diff --git a/oci/layer/tar_extract.go b/oci/layer/tar_extract.go
index 1b8c3d6..d741410 100644
--- a/oci/layer/tar_extract.go
+++ b/oci/layer/tar_extract.go
@@ -402,10 +402,15 @@ func (te *TarExtractor) UnpackEntry(root string, hdr *tar.Header, r io.Reader) (
 	// a symlink).
 	unsafeDir, file := filepath.Split(hdr.Name)
 	if filepath.Join("/", hdr.Name) == "/" {
 		// If we got an entry for the root, then unsafeDir is the full path.
 		unsafeDir, file = hdr.Name, "."
+		// If we're being asked to change the root type, bail because they may
+		// change it to a symlink which we could inadvertently follow.
+		if hdr.Typeflag != tar.TypeDir {
+			return errors.New("malicious tar entry -- refusing to change type of root directory")
+		}
 	}
 	dir, err := securejoin.SecureJoinVFS(root, unsafeDir, te.fsEval)
 	if err != nil {
 		return errors.Wrap(err, "sanitise symlinks in root")
 	}

Fixed code: 		// If we're being asked to change the root type, bail because they may
		// change it to a symlink which we could inadvertently follow.
		if hdr.Typeflag != tar.TypeDir {
			return errors.New("malicious tar entry -- refusing to change type of root directory")
		}
CVE-2011-4966: Credentials Management Errors (CWE-255)
value: modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.
CWE description: Weaknesses in this category are related to the management of credentials.
Published: 2013-03-12T23:55Z
Repository: https://github.com/alandekok/freeradius-server
Language: C
Files changed: src/modules/rlm_unix/rlm_unix.c
Commit date: 2012-02-07 21:00:38 +0100
Commit message: heck for account and password expiration

Diff: diff --git a/src/modules/rlm_unix/rlm_unix.c b/src/modules/rlm_unix/rlm_unix.c
index 5c0fe0fc3..abec68c9d 100644
--- a/src/modules/rlm_unix/rlm_unix.c
+++ b/src/modules/rlm_unix/rlm_unix.c
@@ -270,13 +270,21 @@ static int unix_getpw(UNUSED void *instance, REQUEST *request,
 
 #if defined(HAVE_GETSPNAM) && !defined(M_UNIX)
 	/*
 	 *      Check if password has expired.
 	 */
+	if (spwd && spwd->sp_lstchg > 0 && spwd->sp_max >= 0 &&
+	    (request->timestamp / 86400) > (spwd->sp_lstchg + spwd->sp_max)) {
+		radlog_request(L_AUTH, 0, request, "[%s]: password has expired", name);
+		return RLM_MODULE_REJECT;
+	}
+	/*
+	 *      Check if account has expired.
+	 */
 	if (spwd && spwd->sp_expire > 0 &&
 	    (request->timestamp / 86400) > spwd->sp_expire) {
-		radlog_request(L_AUTH, 0, request, "[%s]: password has expired", name);
+		radlog_request(L_AUTH, 0, request, "[%s]: account has expired", name);
 		return RLM_MODULE_REJECT;
 	}
 #endif
 
 #if defined(__FreeBSD__) || defined(bsdi) || defined(_PWF_EXPIRE)

Vulnerable code: 		radlog_request(L_AUTH, 0, request, "[%s]: password has expired", name);
Fixed code: 	if (spwd && spwd->sp_lstchg > 0 && spwd->sp_max >= 0 &&
	    (request->timestamp / 86400) > (spwd->sp_lstchg + spwd->sp_max)) {
		radlog_request(L_AUTH, 0, request, "[%s]: password has expired", name);
		return RLM_MODULE_REJECT;
	}
	/*
	 *      Check if account has expired.
	 */
		radlog_request(L_AUTH, 0, request, "[%s]: account has expired", name);
CVE-2020-7693: Improper Handling of Exceptional Conditions (CWE-755)
value: Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 5.3
Published: 2020-07-09T14:15Z
Repository: https://github.com/sockjs/sockjs-node
Language: Unknown
Commit date: 2020-03-08 21:36:12 -0400
Commit message: Merge pull request #266 from cakoose/backport-writeHead-fix

writeHead: Don't end() response
CVE-2016-20014: Other (NVD-CWE-Other)
value: In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2022-04-21T04:15Z
Repository: https://github.com/kravietz/pam_tacplus
Language: C
Files changed: pam_tacplus.c
Commit date: 2016-05-05 19:38:34 +0100
Commit message: zero the arep structure (Coverity #115822)

Diff: diff --git a/pam_tacplus.c b/pam_tacplus.c
index 9ca911c..36e7112 100644
--- a/pam_tacplus.c
+++ b/pam_tacplus.c
@@ -514,10 +514,11 @@ int pam_sm_acct_mgmt (pam_handle_t * pamh, int flags,
     struct areply arep;
     struct tac_attrib *attr = NULL;
     int tac_fd;
 
     user = tty = r_addr = NULL;
+    memset(&arep, 0, sizeof(arep));
 
     /* this also obtains service name for authorization
        this should be normally performed by pam_get_item(PAM_SERVICE)
        but since PAM service names are incompatible TACACS+
        we have to pass it via command line argument until a better

Fixed code:     memset(&arep, 0, sizeof(arep));
CVE-2020-13881: Insertion of Sensitive Information into Log File (CWE-532)
value: In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 7.5
Published: 2020-06-06T19:15Z
Repository: https://github.com/kravietz/pam_tacplus
Language: C
Files changed: support.c
Commit date: 2020-06-02 19:28:41 +0200
Commit message: pam: don't leak TACACS+ secret to journald

If journald for syslog is used, the journal is going to store everything,
even DEBUG loglevel messages. Pre-journald logging of system-wide DEBUG
loglevel could be avoided and is not affected in all cases.

With journald presence it's probably safe to no longer log sensitive
details at DEBUG level.

Fix #149

Signed-off-by: Daniel Gollub <dgollub@att.com>

Diff: diff --git a/support.c b/support.c
index 76a5102..ae19968 100644
--- a/support.c
+++ b/support.c
@@ -372,12 +372,12 @@ int _pam_parse(int argc, const char **argv) {
         unsigned long n;
 
         _pam_log(LOG_DEBUG, "%d servers defined", tac_srv_no);
 
         for (n = 0; n < tac_srv_no; n++) {
-            _pam_log(LOG_DEBUG, "server[%lu] { addr=%s, key='%s' }", n, tac_ntop(tac_srv[n].addr->ai_addr),
-                     tac_srv[n].key);
+            _pam_log(LOG_DEBUG, "server[%lu] { addr=%s, key='********' }", n,
+			    tac_ntop(tac_srv[n].addr->ai_addr));
         }
 
         _pam_log(LOG_DEBUG, "tac_service='%s'", tac_service);
         _pam_log(LOG_DEBUG, "tac_protocol='%s'", tac_protocol);
         _pam_log(LOG_DEBUG, "tac_prompt='%s'", tac_prompt);

Vulnerable code:             _pam_log(LOG_DEBUG, "server[%lu] { addr=%s, key='%s' }", n, tac_ntop(tac_srv[n].addr->ai_addr),
                     tac_srv[n].key);
Fixed code:             _pam_log(LOG_DEBUG, "server[%lu] { addr=%s, key='********' }", n,
			    tac_ntop(tac_srv[n].addr->ai_addr));
CVE-2022-0501: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-05T16:15Z
Repository: https://github.com/ptrofimov/beanstalk_console
Language: PHP
Files changed: lib/include.php
Commit date: 2022-02-01 21:13:02 +0530
Commit message: Sanitize input
Diff: diff --git a/lib/include.php b/lib/include.php
index 97b5aea..2e0ba6a 100644
--- a/lib/include.php
+++ b/lib/include.php
@@ -17,11 +17,11 @@ Pheanstalk_ClassLoader::register(dirname(__FILE__));
 
 require_once 'BeanstalkInterface.class.php';
 require_once dirname(__FILE__) . '/../config.php';
 require_once dirname(__FILE__) . '/../src/Storage.php';
 
-$GLOBALS['server'] = !empty($_GET['server']) ? $_GET['server'] : '';
+$GLOBALS['server'] = !empty($_GET['server']) ? htmlspecialchars($_GET['server']) : '';
 $GLOBALS['action'] = !empty($_GET['action']) ? $_GET['action'] : '';
 $GLOBALS['state'] = !empty($_GET['state']) ? $_GET['state'] : '';
 $GLOBALS['count'] = !empty($_GET['count']) ? $_GET['count'] : '';
 $GLOBALS['tube'] = !empty($_GET['tube']) ? $_GET['tube'] : '';
 $GLOBALS['tplMain'] = !empty($_GET['tplMain']) ? $_GET['tplMain'] : '';

Vulnerable code: $GLOBALS['server'] = !empty($_GET['server']) ? $_GET['server'] : '';
Fixed code: $GLOBALS['server'] = !empty($_GET['server']) ? htmlspecialchars($_GET['server']) : '';
CVE-2023-26494: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.


CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-04-24T17:15Z
Repository: https://github.com/TheThingsNetwork/lorawan-stack
Language: JavaScript
Files changed: CHANGELOG.md, pkg/webui/account/views/login/index.js
Commit date: 2023-02-06 13:18:35 +0100
Commit message: account: Prevent open redirects after login

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index d42e3a96f..7cfdd0f8d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,10 +24,12 @@ For details about compatibility between different releases, see the **Commitment
 
 ### Fixed
 
 ### Security
 
+- Fix open redirect vulnerability for Console/Account App logins.
+
 ## [3.24.0] - 2023-02-02
 
 ### Added
 
 - List of end-devices can now be sorted by `last_seen_at` field. Unseen devices will be shown last.
diff --git a/pkg/webui/account/views/login/index.js b/pkg/webui/account/views/login/index.js
index 8d2afbe01..fdddbed39 100644
--- a/pkg/webui/account/views/login/index.js
+++ b/pkg/webui/account/views/login/index.js
@@ -70,10 +70,15 @@ const url = (location, omitQuery = false) => {
 
   if (omitQuery) {
     return next.split('?')[0]
   }
 
+  // Only allow relative redirects to prevent open redirects.
+  if (!next.startsWith('/') || next.startsWith('//')) {
+    return appRoot
+  }
+
   return next
 }
 
 const Login = () => {
   const [error, setError] = useState(undefined)

Fixed code: - Fix open redirect vulnerability for Console/Account App logins.

  // Only allow relative redirects to prevent open redirects.
  if (!next.startsWith('/') || next.startsWith('//')) {
    return appRoot
  }
CVE-2020-15900: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 9.8
Published: 2020-07-28T16:15Z
Repository: https://github.com/ArtifexSoftware/ghostpdl
Language: C
Files changed: psi/zstring.c
Commit date: 2020-07-24 14:51:42 -0700
Commit message: Bug 702582, CVE 2020-15900 Memory Corruption in Ghostscript 9.52

Fix the 'rsearch' calculation for the 'post' size to give the correct
size.  Previous calculation would result in a size that was too large,
and could underflow to max uint32_t. Also fix 'rsearch' to return the
correct 'pre' string with empty string match.

A future change may 'undefine' this undocumented, non-standard operator
during initialization as we do with the many other non-standard internal
PostScript operators and procedures.

Diff: diff --git a/psi/zstring.c b/psi/zstring.c
index 33662dafa..58e1af2b3 100644
--- a/psi/zstring.c
+++ b/psi/zstring.c
@@ -140,17 +140,22 @@ search_impl(i_ctx_t *i_ctx_p, bool forward)
     /* No match */
     make_false(op);
     return 0;
 found:
     op->tas.type_attrs = op1->tas.type_attrs;
-    op->value.bytes = ptr;
-    r_set_size(op, size);
+    op->value.bytes = ptr;				/* match */
+    op->tas.rsize = size;				/* match */
     push(2);
-    op[-1] = *op1;
-    r_set_size(op - 1, ptr - op[-1].value.bytes);
-    op1->value.bytes = ptr + size;
-    r_set_size(op1, count + (!forward ? (size - 1) : 0));
+    op[-1] = *op1;					/* pre */
+    op[-3].value.bytes = ptr + size;			/* post */
+    if (forward) {
+        op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */
+        op[-3].tas.rsize = count;			/* post */
+    } else {
+        op[-1].tas.rsize = count;			/* pre */
+        op[-3].tas.rsize -= count + size;		/* post */
+    }
     make_true(op);
     return 0;
 }
 
 /* Search from the start of the string */

Vulnerable code:     op->value.bytes = ptr;
    r_set_size(op, size);
    op[-1] = *op1;
    r_set_size(op - 1, ptr - op[-1].value.bytes);
    op1->value.bytes = ptr + size;
    r_set_size(op1, count + (!forward ? (size - 1) : 0));
Fixed code:     op->value.bytes = ptr;				/* match */
    op->tas.rsize = size;				/* match */
    op[-1] = *op1;					/* pre */
    op[-3].value.bytes = ptr + size;			/* post */
    if (forward) {
        op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */
        op[-3].tas.rsize = count;			/* post */
    } else {
        op[-1].tas.rsize = count;			/* pre */
        op[-3].tas.rsize -= count + size;		/* post */
    }
CVE-2020-15900: Out-of-bounds Write (CWE-787)
value: A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2020-07-28T16:15Z
Repository: https://github.com/ArtifexSoftware/ghostpdl
Language: C
Files changed: psi/zstring.c
Commit date: 2020-07-24 14:51:42 -0700
Commit message: Bug 702582, CVE 2020-15900 Memory Corruption in Ghostscript 9.52

Fix the 'rsearch' calculation for the 'post' size to give the correct
size.  Previous calculation would result in a size that was too large,
and could underflow to max uint32_t. Also fix 'rsearch' to return the
correct 'pre' string with empty string match.

A future change may 'undefine' this undocumented, non-standard operator
during initialization as we do with the many other non-standard internal
PostScript operators and procedures.

Diff: diff --git a/psi/zstring.c b/psi/zstring.c
index 33662dafa..58e1af2b3 100644
--- a/psi/zstring.c
+++ b/psi/zstring.c
@@ -140,17 +140,22 @@ search_impl(i_ctx_t *i_ctx_p, bool forward)
     /* No match */
     make_false(op);
     return 0;
 found:
     op->tas.type_attrs = op1->tas.type_attrs;
-    op->value.bytes = ptr;
-    r_set_size(op, size);
+    op->value.bytes = ptr;				/* match */
+    op->tas.rsize = size;				/* match */
     push(2);
-    op[-1] = *op1;
-    r_set_size(op - 1, ptr - op[-1].value.bytes);
-    op1->value.bytes = ptr + size;
-    r_set_size(op1, count + (!forward ? (size - 1) : 0));
+    op[-1] = *op1;					/* pre */
+    op[-3].value.bytes = ptr + size;			/* post */
+    if (forward) {
+        op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */
+        op[-3].tas.rsize = count;			/* post */
+    } else {
+        op[-1].tas.rsize = count;			/* pre */
+        op[-3].tas.rsize -= count + size;		/* post */
+    }
     make_true(op);
     return 0;
 }
 
 /* Search from the start of the string */

Vulnerable code:     op->value.bytes = ptr;
    r_set_size(op, size);
    op[-1] = *op1;
    r_set_size(op - 1, ptr - op[-1].value.bytes);
    op1->value.bytes = ptr + size;
    r_set_size(op1, count + (!forward ? (size - 1) : 0));
Fixed code:     op->value.bytes = ptr;				/* match */
    op->tas.rsize = size;				/* match */
    op[-1] = *op1;					/* pre */
    op[-3].value.bytes = ptr + size;			/* post */
    if (forward) {
        op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */
        op[-3].tas.rsize = count;			/* post */
    } else {
        op[-1].tas.rsize = count;			/* pre */
        op[-3].tas.rsize -= count + size;		/* post */
    }
CVE-2015-8813: Server-Side Request Forgery (SSRF) (CWE-918)
value: The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 8.2
Published: 2017-03-03T16:59Z
Repository: https://github.com/umbraco/Umbraco-CMS
Language: C#
Files changed: src/Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs
Commit date: 2015-11-25 18:05:57 +0100
Commit message: Fixes U4-7457 Server side request forgery (xsrf) in feedproxy.aspx

Diff: diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs b/src/Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs
index a938935d2..b304cda0b 100644
--- a/src/Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs
+++ b/src/Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs
@@ -25,11 +25,13 @@ protected void Page_Load(object sender, EventArgs e)
                     {
                         Uri requestUri;
                         if (Uri.TryCreate(url, UriKind.Absolute, out requestUri))
                         {
                             var feedProxyXml = xmlHelper.OpenAsXmlDocument(IOHelper.MapPath(SystemFiles.FeedProxyConfig));
-                            if (feedProxyXml != null && feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null)
+                            if (feedProxyXml != null 
+                                && feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null
+                                && requestUri.Port == 80)
                             {
                                 using (var client = new WebClient())
                                 {
                                     var response = client.DownloadString(requestUri);
 

Vulnerable code:                             if (feedProxyXml != null && feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null)
Fixed code:                             if (feedProxyXml != null 
                                && feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null
                                && requestUri.Port == 80)
CVE-2017-15279: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-10-12T08:29Z
Repository: https://github.com/umbraco/Umbraco-CMS
Language: C#
Files changed: src/Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs, src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs
Commit date: 2017-10-06 14:38:21 +0200
Commit message: Html encode nodenames to prevent XSS attacks. Fixes U4-10497 XSS Vulnerability in page name.

Diff: diff --git a/src/Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs b/src/Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs
index 7e09d0b425..ababea628a 100644
--- a/src/Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs
+++ b/src/Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs
@@ -28,11 +28,11 @@ protected override void OnInit(EventArgs e)
             {
                 throw new InvalidOperationException("No document found with id " + id);
             }
 
             DocumentId = doc.Id;
-            PageName = doc.Name;
+            PageName = Server.HtmlEncode(doc.Name);
             DocumentPath = doc.Path;
 
         }
     }
 }
\ No newline at end of file
diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs
index 70137da920..195ac15ec8 100644
--- a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs
+++ b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs
@@ -25,11 +25,11 @@ public notifications()
         }
 
         protected void Page_Load(object sender, EventArgs e)
         {
             Button1.Text = ui.Text("update");
-            pane_form.Text = ui.Text("notifications", "editNotifications", node.Text, base.getUser());
+            pane_form.Text = ui.Text("notifications", "editNotifications", Server.HtmlEncode(node.Text), base.getUser());
         }
 
         #region Web Form Designer generated code
 
         protected override void OnInit(EventArgs e)

Vulnerable code:             PageName = doc.Name;
            pane_form.Text = ui.Text("notifications", "editNotifications", node.Text, base.getUser());
Fixed code:             PageName = Server.HtmlEncode(doc.Name);
            pane_form.Text = ui.Text("notifications", "editNotifications", Server.HtmlEncode(node.Text), base.getUser());
CVE-2017-15280: Improper Restriction of XML External Entity Reference (CWE-611)
value: XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 5.5
Published: 2017-10-12T08:29Z
Repository: https://github.com/umbraco/Umbraco-CMS
Language: C#
Files changed: src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs
Commit date: 2017-10-06 15:14:41 +0200
Commit message: U4-10506 Importing a specially crafted document type file can cause XXE attack

Diff: diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs
index 27c1724bff..147e7604c1 100644
--- a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs
+++ b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs
@@ -68,14 +68,15 @@ private void InitializeComponent()
 		#endregion
 
 		private void import_Click(object sender, EventArgs e)
 		{
             var xd = new XmlDocument();
+		    xd.XmlResolver = null;
             xd.Load(tempFile.Value);
 
 		    var userId = base.getUser().Id;
-
+            
             var element = XElement.Parse(xd.InnerXml);
 		    var importContentTypes = ApplicationContext.Current.Services.PackagingService.ImportContentTypes(element, userId);
 		    var contentType = importContentTypes.FirstOrDefault();
 		    if (contentType != null)
 		        dtNameConfirm.Text = contentType.Name;
@@ -102,11 +103,12 @@ private void submit_Click(object sender, EventArgs e)
 			tempFile.Value = fileName;
 
 			documentTypeFile.PostedFile.SaveAs(fileName);
 
 			var xd = new XmlDocument();
-			xd.Load(fileName);
+		    xd.XmlResolver = null;
+            xd.Load(fileName);
 			dtName.Text = xd.DocumentElement.SelectSingleNode("//DocumentType/Info/Name").FirstChild.Value;
 			dtAlias.Text = xd.DocumentElement.SelectSingleNode("//DocumentType/Info/Alias").FirstChild.Value;
 
 			Wizard.Visible = false;
 			done.Visible = false;

Vulnerable code: 
			xd.Load(fileName);
Fixed code: 		    xd.XmlResolver = null;
            
		    xd.XmlResolver = null;
            xd.Load(fileName);