hitoshura25/cvefixes huggingface dataset:
CVE-2020-6016 (C++, published 2020-11-18T15:15Z)
Description: value: Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment(), leading to a Heap-Based Buffer Underflow and a free() of memory not from the heap, resulting in a memory corruption and probably even a remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ValveSoftware/GameNetworkingSockets
Files changed:
src/steamnetworkingsockets/clientlib/steamnetworkingsockets_snp.cpp
src/steamnetworkingsockets/clientlib/steamnetworkingsockets_snp.h
Commit message: Drop unreliable segments with weird offset/size.

And be more deliberate about limits of unreliable message/segment sizes.


Vulnerable code:
	if ( cbData > k_cbMaxUnreliableMsgSize && !( pSendMessage->m_nFlags & k_nSteamNetworkingSend_Reliable )  )
			Assert( cbSegmentSize > 0 ); // !TEST! Bogus assert, zero byte messages are OK.  Remove after testing
			// Receive the segment
			bool bLastSegmentInMessage = ( nFrameType & 0x20 ) != 0;
			SNP_ReceiveUnreliableSegment( nCurMsgNum, nOffset, pSegmentData, cbSegmentSize, bLastSegmentInMessage, usecNow );
constexpr int k_cbMaxUnreliableMsgSize = 15*1100;
	char m_buf[ k_cbSteamNetworkingSocketsMaxPlaintextPayloadRecv ];

Fixed code:
	if ( cbData > k_cbMaxUnreliableMsgSizeSend && !( pSendMessage->m_nFlags & k_nSteamNetworkingSend_Reliable )  )
			// Check if offset+size indicates a message larger than what we support.  (Also,
			// protect against malicious sender sending *extremely* large offset causing overflow.)
			if ( (int64)nOffset + cbSegmentSize > k_cbMaxUnreliableMsgSizeRecv || cbSegmentSize > k_cbMaxUnreliableSegmentSizeRecv )
			{

				// Since this is unreliable data, we can just ignore the segment.
				SpewWarningRateLimited( usecNow, "[%s] Ignoring unreliable segment with invalid offset %u size %d\n",
					GetDescription(), nOffset, cbSegmentSize );
			}
			else
			{

				// Receive the segment
				bool bLastSegmentInMessage = ( nFrameType & 0x20 ) != 0;
				SNP_ReceiveUnreliableSegment( nCurMsgNum, nOffset, pSegmentData, cbSegmentSize, bLastSegmentInMessage, usecNow );
			}
constexpr int k_cbMaxUnreliableMsgSizeSend = 15*1100;

// Max possible size of an unreliable segment we could receive.
constexpr int k_cbMaxUnreliableSegmentSizeRecv = k_cbSteamNetworkingSocketsMaxPlaintextPayloadRecv;

// Largest possible total unreliable message we can receive, based on the constraints above
constexpr int k_cbMaxUnreliableMsgSizeRecv = k_nMaxBufferedUnreliableSegments*k_cbMaxUnreliableSegmentSizeRecv;
COMPILE_TIME_ASSERT( k_cbMaxUnreliableMsgSizeRecv > k_cbMaxUnreliableMsgSizeSend + 4096 ); // Postel's law; confirm how much slack we have here
	char m_buf[ k_cbMaxUnreliableSegmentSizeRecv ];
CVE-2020-6017 (C++, published 2020-12-03T14:15Z)
Description: value: Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP_ReceiveUnreliableSegment() when configured to support plain-text messages, leading to a Heap-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ValveSoftware/GameNetworkingSockets
Files changed:
src/steamnetworkingsockets/clientlib/steamnetworkingsockets_snp.cpp
src/steamnetworkingsockets/clientlib/steamnetworkingsockets_snp.h
Commit message: Drop unreliable segments with weird offset/size.

And be more deliberate about limits of unreliable message/segment sizes.


Vulnerable code:
	if ( cbData > k_cbMaxUnreliableMsgSize && !( pSendMessage->m_nFlags & k_nSteamNetworkingSend_Reliable )  )
			Assert( cbSegmentSize > 0 ); // !TEST! Bogus assert, zero byte messages are OK.  Remove after testing
			// Receive the segment
			bool bLastSegmentInMessage = ( nFrameType & 0x20 ) != 0;
			SNP_ReceiveUnreliableSegment( nCurMsgNum, nOffset, pSegmentData, cbSegmentSize, bLastSegmentInMessage, usecNow );
constexpr int k_cbMaxUnreliableMsgSize = 15*1100;
	char m_buf[ k_cbSteamNetworkingSocketsMaxPlaintextPayloadRecv ];

Fixed code:
	if ( cbData > k_cbMaxUnreliableMsgSizeSend && !( pSendMessage->m_nFlags & k_nSteamNetworkingSend_Reliable )  )
			// Check if offset+size indicates a message larger than what we support.  (Also,
			// protect against malicious sender sending *extremely* large offset causing overflow.)
			if ( (int64)nOffset + cbSegmentSize > k_cbMaxUnreliableMsgSizeRecv || cbSegmentSize > k_cbMaxUnreliableSegmentSizeRecv )
			{

				// Since this is unreliable data, we can just ignore the segment.
				SpewWarningRateLimited( usecNow, "[%s] Ignoring unreliable segment with invalid offset %u size %d\n",
					GetDescription(), nOffset, cbSegmentSize );
			}
			else
			{

				// Receive the segment
				bool bLastSegmentInMessage = ( nFrameType & 0x20 ) != 0;
				SNP_ReceiveUnreliableSegment( nCurMsgNum, nOffset, pSegmentData, cbSegmentSize, bLastSegmentInMessage, usecNow );
			}
constexpr int k_cbMaxUnreliableMsgSizeSend = 15*1100;

// Max possible size of an unreliable segment we could receive.
constexpr int k_cbMaxUnreliableSegmentSizeRecv = k_cbSteamNetworkingSocketsMaxPlaintextPayloadRecv;

// Largest possible total unreliable message we can receive, based on the constraints above
constexpr int k_cbMaxUnreliableMsgSizeRecv = k_nMaxBufferedUnreliableSegments*k_cbMaxUnreliableSegmentSizeRecv;
COMPILE_TIME_ASSERT( k_cbMaxUnreliableMsgSizeRecv > k_cbMaxUnreliableMsgSizeSend + 4096 ); // Postel's law; confirm how much slack we have here
	char m_buf[ k_cbMaxUnreliableSegmentSizeRecv ];
CVE-2020-6018 (C++, published 2020-12-02T01:15Z)
Description: value: Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES_GCM_DecryptContext::Decrypt() when compiled using libsodium, leading to a Stack-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ValveSoftware/GameNetworkingSockets
Files changed:
src/common/crypto_libsodium.cpp
Commit message: Check if output buffer is too small.

It really seems like libsodium (whose entire purpose is to make crypto
idiot-proof) making me mess with these details is a flaw in the API design.

Also, correct Hungarian.


Vulnerable code:
    unsigned long long pcbEncryptedDataAndTag_longlong = *pcbEncryptedDataAndTag;
		static_cast<unsigned char*>( pEncryptedDataAndTag ), &pcbEncryptedDataAndTag_longlong,
    *pcbEncryptedDataAndTag = pcbEncryptedDataAndTag_longlong;
    unsigned long long pcbPlaintextData_longlong;

		static_cast<unsigned char*>( pPlaintextData ), &pcbPlaintextData_longlong,
    *pcbPlaintextData = pcbPlaintextData_longlong;

Fixed code:
	// Make sure caller's buffer is big enough to hold the result.
	if ( cbPlaintextData + crypto_aead_aes256gcm_ABYTES > *pcbEncryptedDataAndTag )
	{
		*pcbEncryptedDataAndTag = 0;
		return false;
	}

    unsigned long long cbEncryptedDataAndTag_longlong;
		static_cast<unsigned char*>( pEncryptedDataAndTag ), &cbEncryptedDataAndTag_longlong,
    *pcbEncryptedDataAndTag = cbEncryptedDataAndTag_longlong;
	// Make sure caller's buffer is big enough to hold the result
	if ( cbEncryptedDataAndTag > *pcbPlaintextData + crypto_aead_aes256gcm_ABYTES )
	{
		*pcbPlaintextData = 0;
		return false;
	}

    unsigned long long cbPlaintextData_longlong;
		static_cast<unsigned char*>( pPlaintextData ), &cbPlaintextData_longlong,
    *pcbPlaintextData = cbPlaintextData_longlong;
CVE-2020-6019 (C++, published 2020-11-13T16:15Z)
Description: value: Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::Received_Data(), leading to an exception thrown from libprotobuf and resulting in a crash.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ValveSoftware/GameNetworkingSockets
Files changed:
src/steamnetworkingsockets/clientlib/steamnetworkingsockets_udp.cpp
Commit message: Tweak pointer math to avoid possible integer overflow


Vulnerable code:
		if ( pIn + cbStatsMsgIn > pPktEnd )
			ReportBadUDPPacketFromConnectionPeer( "DataPacket", "stats message size doesn't make sense.  Stats message size %d, packet size %d", cbStatsMsgIn, cbPkt );

Fixed code:
		if ( cbStatsMsgIn > pPktEnd - pIn )
			ReportBadUDPPacketFromConnectionPeer( "DataPacket", "stats message size doesn't make sense.  Stats message size %u, packet size %d", cbStatsMsgIn, cbPkt );
CVE-2021-43837 (Unknown, published 2021-12-16T19:15Z)
Description: value: vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values. When a secret starts with the prefix `!template!`, vault-cli interprets the rest of the contents of the secret as a Jinja2 template. Jinja2 is a powerful templating engine and is not designed to safely render arbitrary templates. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code, making this a Remote Code Execution (RCE) risk. If the content of the vault can be completely trusted, then this is not a problem. Otherwise, if your threat model includes cases where an attacker can manipulate a secret value read from the vault using vault-cli, then this vulnerability may impact you. In 3.0.0, the code related to interpreting vault templated secrets has been removed entirely. Users are advised to upgrade as soon as possible. For users unable to upgrade a workaround does exist. Using the environment variable `VAULT_CLI_RENDER=false` or the flag `--no-render` (placed between `vault-cli` and the subcommand, e.g. `vault-cli --no-render get-all`) or adding `render: false` to the vault-cli configuration yaml file disables rendering and removes the vulnerability. Using the python library, you can use: `vault_cli.get_client(render=False)` when creating your client to get a client that will not render templated secrets and thus operates securely.
Severity: HIGH (CVSS v3 base score: 9.1)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/peopledoc/vault-cli
Files changed:
Commit message: Merge pull request #198 from peopledoc/templates



Vulnerable code:

Fixed code:
CVE-2014-1985 (Ruby, published 2014-04-11T14:55Z)
Description: value: Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter).
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/redmine/redmine
Files changed:
app/controllers/application_controller.rb
test/functional/account_controller_test.rb
Commit message: Fixed back url verification (#16466).

git-svn-id: http://svn.redmine.org/redmine/trunk@13018 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
        if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
    post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http://test.foo/fake'
    assert_redirected_to '/my/page'

Fixed code:
        if ((uri.relative? && back_url.match(%r{\A/\w})) || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
    back_urls = [
      'http://test.foo/fake',
      '//test.foo/fake'
    ]
    back_urls.each do |back_url|
      post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url
      assert_redirected_to '/my/page'
    end
CVE-2015-8346 (Ruby, published 2016-04-12T14:59Z)
Description: value: app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-199 \u2014 Information Management Errors
Weaknesses in this category are related to improper handling of sensitive information.
Repository: https://github.com/redmine/redmine
Files changed:
app/views/timelog/_form.html.erb
Commit message: Fixed that time logging form may disclose subjects of issues that are not visible (#21150).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@14795 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
    <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" if @time_entry.issue %></span>

Fixed code:
    <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" if @time_entry.issue.try(:visible?) %></span>
CVE-2015-8474 (Ruby, published 2016-04-12T14:59Z)
Description: value: Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back_url parameter, as demonstrated by "@attacker.com," a different vulnerability than CVE-2014-1985.
Severity: MEDIUM (CVSS v3 base score: 7.4)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/redmine/redmine
Files changed:
app/controllers/application_controller.rb
test/functional/account_controller_test.rb
Commit message: Open redirect vulnerability (#19577).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@14560 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
    if back_url.present? && valid_back_url?(back_url)
      redirect_to(back_url)
  # Returns true if back_url is a valid url for redirection, otherwise false
  def valid_back_url?(back_url)
    if uri.host.present? && uri.host != request.host
    if uri.path.match(%r{/(login|account/register)})
    if relative_url_root.present? && !uri.path.starts_with?(relative_url_root)
    return true
      'http://test.host/redmine/%2e%2e/fake'

Fixed code:
    if back_url.present? && valid_url = validate_back_url(back_url)
      redirect_to(valid_url)
  # Returns a validated URL string if back_url is a valid url for redirection,
  # otherwise false
  def validate_back_url(back_url)
    [:scheme, :host, :port].each do |component|
      if uri.send(component).present? && uri.send(component) != request.send(component)
        return false
      end
      uri.send(:"#{component}=", nil)
    end
    # Always ignore basic user:password in the URL
    uri.userinfo = nil

    path = uri.to_s
    # Ensure that the remaining URL starts with a slash, followed by a
    # non-slash character or the end
    if path !~ %r{\A/([^/]|\z)}
    if path.match(%r{/(login|account/register)})
    if relative_url_root.present? && !path.starts_with?(relative_url_root)
    return path
  end
  private :validate_back_url

  def valid_back_url?(back_url)
    !!validate_back_url(back_url)
      'http://test.host/',
      'http://test.host/redmine/%2e%2e/fake',
      '//test.foo/fake',
      'http://test.host//fake',
      'http://test.host/\n//fake',
      '//bar@test.foo',
      '//test.foo',
      '////test.foo',
      '@test.foo',
      'fake@test.foo'
CVE-2015-8537 (Ruby, published 2016-04-12T14:59Z)
Description: value: app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/redmine/redmine
Files changed:
app/views/journals/index.builder
test/functional/journals_controller_test.rb
Commit message: Information leak in Atom feed (#21419).

Patch by Jens Krämer.

git-svn-id: http://svn.redmine.org/redmine/trunk@14913 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
        details_to_strings(change.details, false).each do |string|
    :trackers, :issue_statuses, :enumerations, :custom_fields, :custom_values, :custom_fields_projects

Fixed code:
        details_to_strings(change.visible_details, false).each do |string|
    :trackers, :issue_statuses, :enumerations, :custom_fields, :custom_values, :custom_fields_projects, :projects_trackers
  def test_index_should_show_visible_custom_fields_only
    Issue.destroy_all
    field_attributes = {:field_format => 'string', :is_for_all => true, :is_filter => true, :trackers => Tracker.all}
    @fields = []
    @fields << (@field1 = IssueCustomField.create!(field_attributes.merge(:name => 'Field 1', :visible => true)))
    @fields << (@field2 = IssueCustomField.create!(field_attributes.merge(:name => 'Field 2', :visible => false, :role_ids => [1, 2])))
    @fields << (@field3 = IssueCustomField.create!(field_attributes.merge(:name => 'Field 3', :visible => false, :role_ids => [1, 3])))
    @issue = Issue.generate!(
      :author_id => 1,
      :project_id => 1,
      :tracker_id => 1,
      :custom_field_values => {@field1.id => 'Value0', @field2.id => 'Value1', @field3.id => 'Value2'}
    )
    @issue.init_journal(User.find(1))
    @issue.update_attribute :custom_field_values, {@field1.id => 'NewValue0', @field2.id => 'NewValue1', @field3.id => 'NewValue2'}


    user_with_role_on_other_project = User.generate!
    User.add_to_project(user_with_role_on_other_project, Project.find(2), Role.find(3))
    users_to_test = {
      User.find(1) => [@field1, @field2, @field3],
      User.find(3) => [@field1, @field2],
      user_with_role_on_other_project => [@field1], # should see field1 only on Project 1
      User.generate! => [@field1],
      User.anonymous => [@field1]
    }

    users_to_test.each do |user, visible_fields|
      get :index, :format => 'atom', :key => user.rss_key
      @fields.each_with_index do |field, i|
        if visible_fields.include?(field)
          assert_select "content[type=html]", { :text => /NewValue#{i}/, :count => 1 }, "User #{user.id} was not able to view #{field.name} in API"
        else
          assert_select "content[type=html]", { :text => /NewValue#{i}/, :count => 0 }, "User #{user.id} was able to view #{field.name} in API"
        end
      end
    end

  end
CVE-2017-15568 (Ruby, published 2017-10-18T02:29Z)
Description: value: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/redmine/redmine
Files changed:
app/helpers/application_helper.rb
Commit message: Ensure that values of multi-value fields are HTML-escaped in issue history (#27186).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@16985 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
      object.map {|o| format_object(o, html)}.join(', ').html_safe

Fixed code:
      formatted_objects = object.map {|o| format_object(o, html)}
      html ? safe_join(formatted_objects, ', ') : formatted_objects.join(', ')
CVE-2017-15569 (Ruby, published 2017-10-18T02:29Z)
Description: value: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/redmine/redmine
Files changed:
app/helpers/queries_helper.rb
Commit message: Ensure that values of multi-value fields are HTML-escaped in issue list (#27186).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@16984 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
      value.collect {|v| column_value(column, item, v)}.compact.join(', ').html_safe

Fixed code:
      values = value.collect {|v| column_value(column, item, v)}.compact
      safe_join(values, ', ')
CVE-2017-15570 (Ruby, published 2017-10-18T02:29Z)
Description: value: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/redmine/redmine
Files changed:
app/views/timelog/_list.html.erb
Commit message: Don't use raw output in timelog (#27186).

git-svn-id: http://svn.redmine.org/redmine/trunk@16983 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
    <%= raw @query.inline_columns.map {|column| "<td class=\"#{column.css_classes}\">#{column_content(column, entry)}</td>"}.join %>

Fixed code:
    <% @query.inline_columns.each do |column| %>
    <%= content_tag('td', column_content(column, entry), :class => column.css_classes) %>
    <% end %>
CVE-2017-15571 (Ruby, published 2017-10-18T02:29Z)
Description: value: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/redmine/redmine
Files changed:
app/views/issues/_list.html.erb
Commit message: Don't use raw output (#27186).

git-svn-id: http://svn.redmine.org/redmine/trunk@16971 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
    <%= raw query.inline_columns.map {|column| "<td class=\"#{column.css_classes}\">#{column_content(column, issue)}</td>"}.join %>

Fixed code:
    <% query.inline_columns.each do |column| %>
    <%= content_tag('td', column_content(column, issue), :class => column.css_classes) %>
    <% end %>