hitoshura25/cvefixes huggingface dataset:
CVE-2016-15020 (PHP, published 2023-01-16T11:15Z)
Description: value: A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/liftkit/database
Files changed:
src/Query/Query.php
Commit message: Fixed orderBy injection vulnerability


Vulnerable code:
		public function orderBy ($field, $direction = 'ASC')
					$orderBys[] = $orderBy['field'] . ' ' . $orderBy['direction'];

Fixed code:
		public function orderBy ($field, $direction = self::QUERY_ORDER_ASC)
					$direction = (strtoupper($orderBy['direction']) == self::QUERY_ORDER_DESC)
						? self::QUERY_ORDER_DESC
						: self::QUERY_ORDER_ASC;

					$orderBys[] = $orderBy['field'] . ' ' . $direction;
CVE-2021-32568 (Python, published 2021-09-06T12:15Z)
Description: value: mrdoc is vulnerable to Deserialization of Untrusted Data
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/zmister2016/mrdoc
Files changed:
CHANGES.md
MrDoc/settings.py
app_doc/import_utils.py
Commit message: 修复用户上传文件中的yaml解析漏洞


Vulnerable code:
VERSIONS = '0.6.9'
                yaml_str = yaml.load(yaml_file.read())

Fixed code:
### v0.7.1 2021-09

- [修复]用户上传文件中yaml加载的安全漏洞；


VERSIONS = '0.7.0'
                yaml_str = yaml.safe_load(yaml_file.read())
CVE-2011-1937 (Perl, published 2011-05-31T20:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/webmin/webmin
Files changed:
useradmin/user-lib.pl
Commit message: Fix possible XSS attack due to user's real name not being escaped


Vulnerable code:
	push(@cols, $gidgrp{$u->{'gid'}}||$u->{'gid'});
	push(@cols, $u->{'real'});
	push(@cols, $u->{'home'});
	push(@cols, $u->{'shell'});
	push(@cols, $llogin{$u->{'user'}}) if ($lshow);
		push(@cols, $g->{'desc'});

Fixed code:
	push(@cols, $gidgrp{$u->{'gid'}} || $u->{'gid'});
	push(@cols, &html_escape($u->{'real'}));
	push(@cols, &html_escape($u->{'home'}));
	push(@cols, &html_escape($u->{'shell'}));
	push(@cols, &html_escape($llogin{$u->{'user'}})) if ($lshow);
		push(@cols, &html_escape($g->{'desc'}));
CVE-2012-2981 (Other, published 2012-09-11T18:55Z)
Description: value: Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type (aka monitor type name) parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/webmin/webmin
Files changed:
status/edit_mon.cgi
status/lang/en
status/save_mon.cgi
Commit message: Prevent passing in of monitor type that could contain invalid characters https://sourceforge.net/tracker/index.php?func=detail&aid=3542038&group_id=17457&atid=117457#


Vulnerable code:

Fixed code:
	$in{'type'} =~ /^[a-zA-Z0-9\_\-\.]+$/ || &error($text{'mon_etype'});
mon_etype=Invalid monitor type name
	$in{'type'} =~ /^[a-zA-Z0-9\_\-\.]+$/ || &error($text{'mon_etype'});
CVE-2012-2983 (Other, published 2012-09-11T18:55Z)
Description: value: file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/webmin/webmin
Files changed:
file/edit_html.cgi
Commit message: Add access control check when reading HTML file https://sourceforge.net/tracker/index.php?func=detail&aid=3542038&group_id=17457&atid=117457#


Vulnerable code:

Fixed code:
if (!&can_access($in{'file'})) {
	# ACL rules prevent access to file
	&error_exit(&text('view_eaccess', &html_escape($in{'file'})));
	}
CVE-2017-15644 (Perl, published 2017-10-19T22:29Z)
Description: value: SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/webmin/webmin
Files changed:
web-lib-funcs.pl
Commit message: Escape potentially malicious HTTP headers


Vulnerable code:
	else { &error($h); }
	else { &error("Download failed : $line"); }
		else { &error("Invalid Location header $header{'location'}"); }
			else { &error("Failed to write to $destfile : $!"); }

Fixed code:
	else { &error(&html_escape($h)); }
	else { &error("Download failed : ".&html_escape($line)); }
		else { &error("Invalid Location header ".
			      &html_escape($header{'location'})); }
			else { &error("Failed to write to ".&html_escape($destfile)." : ".&html_escape("$!")); }
CVE-2017-15645 (Perl, published 2017-10-19T22:29Z)
Description: value: CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/webmin/webmin
Files changed:
web-lib-funcs.pl
Commit message: Escape potentially malicious HTTP headers


Vulnerable code:
	else { &error($h); }
	else { &error("Download failed : $line"); }
		else { &error("Invalid Location header $header{'location'}"); }
			else { &error("Failed to write to $destfile : $!"); }

Fixed code:
	else { &error(&html_escape($h)); }
	else { &error("Download failed : ".&html_escape($line)); }
		else { &error("Invalid Location header ".
			      &html_escape($header{'location'})); }
			else { &error("Failed to write to ".&html_escape($destfile)." : ".&html_escape("$!")); }
CVE-2017-15646 (Perl, published 2017-10-19T22:29Z)
Description: value: Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/webmin/webmin
Files changed:
web-lib-funcs.pl
Commit message: Escape potentially malicious HTTP headers


Vulnerable code:
	else { &error($h); }
	else { &error("Download failed : $line"); }
		else { &error("Invalid Location header $header{'location'}"); }
			else { &error("Failed to write to $destfile : $!"); }

Fixed code:
	else { &error(&html_escape($h)); }
	else { &error("Download failed : ".&html_escape($line)); }
		else { &error("Invalid Location header ".
			      &html_escape($header{'location'})); }
			else { &error("Failed to write to ".&html_escape($destfile)." : ".&html_escape("$!")); }
CVE-2017-17089 (Other, published 2017-12-30T17:29Z)
Description: value: custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/webmin/webmin
Files changed:
custom/run.cgi
Commit message: HTML escape command description


Vulnerable code:
		&ui_print_unbuffered_header($cmd->{'desc'}, $text{'run_title'},
					    "", -d "help" ? "run" : undef);

Fixed code:
		&ui_print_unbuffered_header(
			&html_escape($cmd->{'desc'}), $text{'run_title'},
			"", -d "help" ? "run" : undef);
CVE-2017-2106 (Perl, published 2017-04-28T16:59Z)
Description: value: Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/webmin/webmin
Files changed:
miniserv.pl
Commit message: Strip out unsafe HTML from error messages


Vulnerable code:
	&http_error(403, "Access denied for $acptip");
		&http_error(403, "Access denied for $acptip by TCP wrappers");
			    "Waited for that $to seconds for start of headers");
		&http_error(400, "Bad Header $headline");
		&http_error(400, "Bad Header Contents $lastheader");
	&http_error(405, "Method $method is not supported");
	&http_error(400, "Bad Request method $method");
				&http_error(500, "Unix user $authuser does not exist");
		&http_error(403, "Access denied for $acptip for $baseauthuser");
	&http_error(403, "Access denied to ".&html_escape($page));
		 &urlize($df), &html_escape($df), $fdate, $stbuf[7]);
		&write_data("<pre>$_[2]</pre>\n");
		    "Received excessive line <pre>$main::read_buffer</pre>");
		&http_error(500, "Unix user $authuser does not exist");

Fixed code:
	&http_error(403, "Access denied for ".&html_strip($acptip));
		&http_error(403, "Access denied for ".&html_strip($acptip).
				 " by TCP wrappers");
			    "Waited for $to seconds for start of headers");
		&http_error(400, "Bad Header ".&html_strip($headline));
		&http_error(400, "Bad Header Contents ".
				 &html_strip($lastheader));
	&http_error(405, "Method ".&html_strip($method)." is not supported");
	&http_error(400, "Bad Request method ".&html_strip($method));
				&http_error(500, "Unix user ".
				  &html_strip($authuser)." does not exist");
		&http_error(403, "Access denied for $acptip for ".
				 &html_strip($baseauthuser));
	&http_error(403, "Access denied to ".&html_strip($page));
		 &urlize($df), &html_strip($df), $fdate, $stbuf[7]);
		&write_data("<p>$_[2]</p>\n");
		    "Received excessive line <pre>".&html_strip($main::read_buffer)."</pre>");
		&http_error(500, "Unix user ".&html_strip($authuser).
				 " does not exist");
sub html_strip
{
my ($tmp) = @_;
$tmp =~ s/<[^>]*>//g;
return $tmp;
}
CVE-2017-9313 (Other, published 2017-07-04T02:29Z)
Description: value: Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/webmin/webmin
Files changed:
acl/save_user.cgi
software/file_info.cgi
software/search.cgi
webmin/change_referers.cgi
Commit message: escape some params


Vulnerable code:
	&error(&text('save_ename', $in{'name'}));
	$clash && &error(&text('save_edup', $in{'name'}));
	print "<b>",&text('file_notfound', "<tt>$f</tt>"),"</b><p>\n";
	print "<b>",&text('search_match', "<tt>$s</tt>"),"</b><p>\n";
	$r =~ /^[a-z0-9\.\-\_]+$/ || &error(&text('referers_ehost', $r));

Fixed code:
	&error(&text('save_ename', &html_escape($in{'name'})));
	$clash && &error(&text('save_edup', &html_escape($in{'name'})));
	print "<b>",&text('file_notfound',
			  "<tt>".&html_escape($f)."</tt>"),"</b><p>\n";
	print "<b>",&text('search_match',
			  "<tt>".&html_escape($s)."</tt>"),"</b><p>\n";
	$r =~ /^[a-z0-9\.\-\_]+$/ ||
		&error(&text('referers_ehost', &html_escape($r)));
CVE-2017-9313 (Other, published 2017-07-04T02:29Z)
Description: value: Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/webmin/webmin
Files changed:
man/view_man.cgi
Commit message: Escape untrusted params


Vulnerable code:
	print "<p><b>",&text('man_noentry', "<tt>$in{'page'}</tt>"),
	      "</b><p>\n";
		&show_view_table(&text('man_header', $in{'page'}, $in{'sec'}),
				 $out);
		&show_view_table(&text('man_header', $in{'page'}, $in{'sec'}),
				 "<pre>".&html_escape($out)."</pre>");

Fixed code:
	print "<p><b>",&text('man_noentry',
		     "<tt>".&html_escape($in{'page'})."</tt>"),"</b><p>\n";
		&show_view_table(
			&text('man_header',
			      &html_escape($in{'page'}),
			      &html_escape($in{'sec'})),
			$out);
		&show_view_table(
			&text('man_header',
			      &html_escape($in{'page'}),
			      &html_escape($in{'sec'})),
			"<pre>".&html_escape($out)."</pre>");
CVE-2019-15642 (Perl, published 2019-08-26T18:15Z)
Description: value: rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/webmin/webmin
Files changed:
web-lib-funcs.pl
Commit message: Object names cannot contact special characters


Vulnerable code:
elsif ($v[0] =~ /^OBJECT\s+(.*)$/) {

Fixed code:
elsif ($v[0] =~ /^OBJECT\s+([A-Za-z0-9_:]+)$/) {
CVE-2022-36446 (Perl, published 2022-07-25T06:15Z)
Description: value: software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/webmin/webmin
Files changed:
software/apt-lib.pl
Commit message: Command to show in the UI should not be escaped, but the actual command must be


Vulnerable code:
$update =~ s/\\(-)|\\(.)/$1$2/g;
print "<b>",&text('apt_install', "<tt>$cmd</tt>"),"</b><p>\n";

Fixed code:
local $uicmd = "$apt_get_command -y ".($force ? " -f" : "")." install $update";
print "<b>",&text('apt_install', "<tt>".&html_escape($uicmd)."</tt>"),"</b><p>\n";
CVE-2022-3844 (Other, published 2022-11-02T20:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.003 is able to address this issue. The patch is identified as d3d33af3c0c3fd3a889c84e287a038b7a457d811. It is recommended to upgrade the affected component. VDB-212862 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/webmin/webmin
Files changed:
xterm/index.cgi
Commit message: Clean up code and prevent HTML attacks on untrusted inputs


Vulnerable code:
# Launch the shell server on that port
&foreign_require("cron");
my $shellserver_cmd = "$module_config_directory/shellserver.pl";
if (!-r $shellserver_cmd) {
	&cron::create_wrapper($shellserver_cmd, $module_name, "shellserver.pl");
	}
if ($user eq "root") {
	my $username = $in{'user'};
	if ($username) {
	my @uinfo = getpwnam($username);
		if (@uinfo) {
			$user = $username;
			}
		else {
			&error(&text('index_euser', $username));
			}
		}
defined(getpwnam($user)) || &error(&text('index_euser', $user));

Fixed code:
# Check permissions for user to run as
if ($user eq "root" && $in{'user'}) {
	defined(getpwnam($in{'user'})) ||
		&error(&text('index_euser', &html_escape($in{'user'})));
	$user = $in{'user'};
# Launch the shell server on the allocated port
&foreign_require("cron");
my $shellserver_cmd = "$module_config_directory/shellserver.pl";
if (!-r $shellserver_cmd) {
	&cron::create_wrapper($shellserver_cmd, $module_name, "shellserver.pl");
	}
defined(getpwnam($user)) || &error(&text('index_euser', &html_escape($user)));
CVE-2018-19198 (C++, published 2018-11-12T15:29Z)
Description: value: An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/uriparser/uriparser
Files changed:
src/UriQuery.c
test/test.cpp
Commit message: UriQuery.c: Fix out-of-bounds-write in ComposeQuery and ...Ex

Reported by Google Autofuzz team


Vulnerable code:

Fixed code:
				ampersandLen = 1;
		TEST_ADD(UriSuite::testQueryCompositionMathWrite_GoogleAutofuzz113244572)
	void testQueryCompositionMathWrite_GoogleAutofuzz113244572() {
		UriQueryListA second = { .key = "\x11", .value = NULL, .next = NULL };
		UriQueryListA first = { .key = "\x01", .value = "\x02", .next = &second };

		const UriBool spaceToPlus = URI_TRUE;
		const UriBool normalizeBreaks = URI_FALSE;  /* for factor 3 but 6 */

		const int charsRequired = (3 + 1 + 3) + 1 + (3);

		{
			// Minimum space to hold everything fine
			const char * const expected = "%01=%02" "&" "%11";
			char dest[charsRequired + 1];
			int charsWritten;
			TEST_ASSERT(uriComposeQueryExA(dest, &first, sizeof(dest),
					&charsWritten, spaceToPlus, normalizeBreaks)
				== URI_SUCCESS);
			TEST_ASSERT(! strcmp(dest, expected));
			TEST_ASSERT(charsWritten == strlen(expected) + 1);
		}

		{
			// Previous math failed to take ampersand into account
			char dest[charsRequired + 1 - 1];
			int charsWritten;
			TEST_ASSERT(uriComposeQueryExA(dest, &first, sizeof(dest),
					&charsWritten, spaceToPlus, normalizeBreaks)
				== URI_ERROR_OUTPUT_TOO_LARGE);
		}
	}
CVE-2018-19199 (Other, published 2018-11-12T15:29Z)
Description: value: An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/uriparser/uriparser
Files changed:
ChangeLog
src/UriQuery.c
Commit message: UriQuery.c: Catch integer overflow in ComposeQuery and ...Ex


Vulnerable code:
		const int keyRequiredChars = worstCase * keyLen;
		const int valueRequiredChars = worstCase * valueLen;

Fixed code:
  * Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx*
      Thanks to Google Autofuzz team for the report!
#include <limits.h>



		int keyRequiredChars;
		int valueRequiredChars;

		if ((keyLen >= INT_MAX / worstCase) || (valueLen >= INT_MAX / worstCase)) {
			return URI_ERROR_OUTPUT_TOO_LARGE;
		}
		keyRequiredChars = worstCase * keyLen;
		valueRequiredChars = worstCase * valueLen;
CVE-2018-19200 (C, published 2018-11-12T15:29Z)
Description: value: An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/uriparser/uriparser
Files changed:
src/UriCommon.c
Commit message: ResetUri: Protect against NULL


Vulnerable code:

Fixed code:
	if (uri == NULL) {
		return;
	}