hitoshura25/cvefixes huggingface dataset:
CVE-2016-8884 (C, published 2017-03-28T14:59Z)
Description: value: The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/base/jas_seq.c
src/libjasper/bmp/bmp_dec.c
Commit message: Fixed a problem with a null pointer dereference in the BMP decoder.


Vulnerable code:
		return 0;
		return 0;
	  ("BMP information: len %d; width %d; height %d; numplanes %d; "
	  "depth %d; enctype %d; siz %d; hres %d; vres %d; numcolors %d; "
	  "mincolors %d\n", info->len, info->width, info->height, info->numplanes,
	  info->depth, info->enctype, info->siz, info->hres, info->vres,
	  info->numcolors, info->mincolors));
		bmp_info_destroy(info);
		return 0;
		return 0;
			bmp_info_destroy(info);
			return 0;
		bmp_info_destroy(info);
		return 0;
		bmp_info_destroy(info);
		jas_image_destroy(image);
		return 0;

Fixed code:
	if (numrows < 0 || numcols < 0) {
		return 0;
	}

	image = 0;
	info = 0;

		goto error;
		//return 0;
		//return 0;
		goto error;
	  ("BMP information: len %ld; width %ld; height %ld; numplanes %d; "
	  "depth %d; enctype %ld; siz %ld; hres %ld; vres %ld; numcolors %ld; "
	  "mincolors %ld\n", JAS_CAST(long, info->len),
	  JAS_CAST(long, info->width), JAS_CAST(long, info->height),
	  JAS_CAST(long, info->numplanes), JAS_CAST(long, info->depth),
	  JAS_CAST(long, info->enctype), JAS_CAST(long, info->siz),
	  JAS_CAST(long, info->hres), JAS_CAST(long, info->vres),
	  JAS_CAST(long, info->numcolors), JAS_CAST(long, info->mincolors)));

	if (info->width < 0 || info->height < 0 || info->numplanes < 0 ||
	  info->depth < 0 || info->siz < 0 || info->hres < 0 || info->vres < 0) {
		jas_eprintf("corrupt bit stream\n");
		goto error;
	}
		//bmp_info_destroy(info);
		//return 0;
		goto error;
		goto error;
		//return 0;
			//bmp_info_destroy(info);
			//return 0;
			goto error;
		//bmp_info_destroy(info);
		//return 0;
		goto error;
		//bmp_info_destroy(info);
		//jas_image_destroy(image);
		//return 0;
		goto error;

error:
	if (info) {
		bmp_info_destroy(info);
	}
	if (image) {
		jas_image_destroy(image);
	}
	return 0;
CVE-2016-8887 (C, published 2017-03-23T18:59Z)
Description: value: The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jp2/jp2_cod.c
src/libjasper/jp2/jp2_dec.c
Commit message: Fixed a bug that resulted in the destruction of JP2 box data that had never
been constructed in the first place.


Vulnerable code:
			jas_eprintf("box type %s\n", box->info->name);

Fixed code:
	JAS_DBGLOG(10, (
	  "preliminary processing of JP2 box: type=%c%s%c (0x%08x); length=%d\n",
	  '"', boxinfo->name, '"', box->type, box->len
	  ));
			// Mark the box data as never having been constructed
			// so that we will not errantly attempt to destroy it later.
			box->ops = &jp2_boxinfo_unk.ops;
			jas_eprintf("got box type %s\n", box->info->name);
CVE-2016-9387 (C, published 2017-03-23T18:59Z)
Description: value: Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_dec.c
Commit message: Fixed another integer overflow problem.


Vulnerable code:
	dec->numtiles = dec->numhtiles * dec->numvtiles;

Fixed code:
	size_t size;
	if (!jas_safe_size_mul(dec->numhtiles, dec->numvtiles, &size)) {
		return -1;
	}
	dec->numtiles = size;
CVE-2016-9388 (C, published 2017-03-23T18:59Z)
Description: value: The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/ras/ras_dec.c
src/libjasper/ras/ras_enc.c
Commit message: Fixed a few bugs in the RAS encoder and decoder where errors were tested
with assertions instead of being gracefully handled.


Vulnerable code:
		data[i] = jas_matrix_create(1, jas_image_width(image));
		assert(data[i]);
					return -1;
				return -1;
				return -1;
		assert(numcolors <= RAS_CMAP_MAXSIZ);
		data[i] = jas_matrix_create(jas_image_height(image), jas_image_width(image));
		assert(data[i]);
				return -1;
					return -1;
				return -1;
				return -1;

Fixed code:
	assert(jas_image_numcmpts(image) <= 3);

	for (i = 0; i < 3; ++i) {
		data[i] = 0;
	}

		if (!(data[i] = jas_matrix_create(1, jas_image_width(image)))) {
			goto error;
		}
					goto error;
				goto error;
				goto error;
		data[i] = 0;

error:
	for (i = 0; i < 3; ++i) {
		if (data[i]) {
			jas_matrix_destroy(data[i]);
		}
	}
	return -1;
		if (numcolors > RAS_CMAP_MAXSIZ) {
			return -1;
		}
	assert(numcmpts <= 3);

	for (i = 0; i < 3; ++i) {
		data[i] = 0;
	}

		if (!(data[i] = jas_matrix_create(jas_image_height(image),
		  jas_image_width(image)))) {
			goto error;
		}
				goto error;
					goto error;
				goto error;
				goto error;
		data[i] = 0;

error:
	for (i = 0; i < numcmpts; ++i) {
		if (data[i]) {
			jas_matrix_destroy(data[i]);
		}
	}
	return -1;
CVE-2016-9389 (C, published 2017-03-23T18:59Z)
Description: value: The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/base/jas_image.c
src/libjasper/include/jasper/jas_image.h
src/libjasper/jpc/jpc_dec.c
Commit message: The component domains must be the same for the ICT/RCT in the JPC codec.
This was previously enforced with an assertion.
Now, it is handled in a more graceful manner.


Vulnerable code:

Fixed code:
#include <stdbool.h>
bool jas_image_cmpt_domains_same(jas_image_t *image)
{
	int cmptno;
	jas_image_cmpt_t *cmpt;
	jas_image_cmpt_t *cmpt0;

	cmpt0 = image->cmpts_[0];
	for (cmptno = 1; cmptno < image->numcmpts_; ++cmptno) {
		cmpt = image->cmpts_[cmptno];
		if (cmpt->tlx_ != cmpt0->tlx_ || cmpt->tly_ != cmpt0->tly_ ||
		  cmpt->hstep_ != cmpt0->hstep_ || cmpt->vstep_ != cmpt0->vstep_ ||
		  cmpt->width_ != cmpt0->width_ || cmpt->height_ != cmpt0->height_) {
			return 0;
		}
	}
	return 1;
}

#include <stdbool.h>
// Test if all components are specified at the same positions in space. */
bool jas_image_cmpt_domains_same(jas_image_t *image);

		if (!jas_image_cmpt_domains_same(dec->image)) {
			jas_eprintf("RCT requires all components have the same domain\n");
			return -1;
		}
		if (!jas_image_cmpt_domains_same(dec->image)) {
			jas_eprintf("RCT requires all components have the same domain\n");
			return -1;
		}
CVE-2016-9390 (C, published 2017-03-23T18:59Z)
Description: value: The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_cs.c
src/libjasper/jpc/jpc_dec.c
Commit message: Ensure that not all tiles lie outside the image area.


Vulnerable code:

Fixed code:
	if (siz->tilexoff >= siz->width || siz->tileyoff >= siz->height) {
		jas_eprintf("all tiles are outside the image area\n");
		return -1;
	}
CVE-2016-9391 (C, published 2017-03-23T18:59Z)
Description: value: The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_bs.c
src/libjasper/jpc/jpc_cs.c
src/libjasper/jpc/jpc_dec.c
Commit message: Changed the JPC bitstream code to more gracefully handle a request
for a larger sized integer than what can be handled (i.e., return
with an error instead of failing an assert).


Vulnerable code:
	assert(n >= 0 && n < 32);
	assert(n >= 0 && n < 32);
		  i, (unsigned) JPC_QCX_GETEXPN(qcd->compparms.stepsizes[i]),
		  i, (unsigned) JPC_QCX_GETMANT(qcd->compparms.stepsizes[i]));

Fixed code:
	//assert(n >= 0 && n < 32);
	if (n < 0 || n >= 32) {
		return -1;
	}
	//assert(n >= 0 && n < 32);
	if (n < 0 || n >= 32) {
		return EOF;
	}
		  i, JAS_CAST(unsigned, JPC_QCX_GETEXPN(qcd->compparms.stepsizes[i])),
		  i, JAS_CAST(unsigned, JPC_QCX_GETMANT(qcd->compparms.stepsizes[i])));
//jas_eprintf("DEBUG %d %d %d %d %d\n", bandno, expn, numrlvls, bandno, ((numrlvls - 1) - (numrlvls - 1 - ((bandno > 0) ? ((bandno + 2) / 3) : (0)))));
CVE-2016-9392 (C, published 2017-03-23T18:59Z)
Description: value: The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_cs.c
Commit message: Added some missing sanity checks on the data in a SIZ marker segment.


Vulnerable code:
		return -1;
	if (!siz->width || !siz->height || !siz->tilewidth ||
	  !siz->tileheight || !siz->numcomps || siz->numcomps > 16384) {
		return -1;
	if (siz->tilexoff >= siz->width || siz->tileyoff >= siz->height) {
		jas_eprintf("all tiles are outside the image area\n");
		return -1;
		return -1;
			jas_free(siz->comps);
			return -1;
			jas_free(siz->comps);
			return -1;
			jas_free(siz->comps);
			return -1;
		jas_free(siz->comps);
		return -1;

Fixed code:
	siz->comps = 0;

		goto error;
	if (!siz->width || !siz->height) {
		jas_eprintf("reference grid cannot have zero area\n");
		goto error;
	if (!siz->tilewidth || !siz->tileheight) {
		jas_eprintf("tile cannot have zero area\n");
		goto error;
	}
	if (!siz->numcomps || siz->numcomps > 16384) {
		jas_eprintf("number of components not in permissible range\n");
		goto error;
	if (siz->xoff >= siz->width) {
		jas_eprintf("XOsiz not in permissible range\n");
		goto error;
	}
	if (siz->yoff >= siz->height) {
		jas_eprintf("YOsiz not in permissible range\n");
		goto error;
	}
	if (siz->tilexoff > siz->xoff || siz->tilexoff + siz->tilewidth <= siz->xoff) {
		jas_eprintf("XTOsiz not in permissible range\n");
		goto error;
	}
	if (siz->tileyoff > siz->yoff || siz->tileyoff + siz->tileheight <= siz->yoff) {
		jas_eprintf("YTOsiz not in permissible range\n");
		goto error;
	}

		goto error;
			goto error;
			goto error;
			goto error;
		goto error;

error:
	if (siz->comps) {
		jas_free(siz->comps);
	}
	return -1;
CVE-2016-9393 (C, published 2017-03-23T18:59Z)
Description: value: The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_cs.c
Commit message: Added some missing sanity checks on the data in a SIZ marker segment.


Vulnerable code:
		return -1;
	if (!siz->width || !siz->height || !siz->tilewidth ||
	  !siz->tileheight || !siz->numcomps || siz->numcomps > 16384) {
		return -1;
	if (siz->tilexoff >= siz->width || siz->tileyoff >= siz->height) {
		jas_eprintf("all tiles are outside the image area\n");
		return -1;
		return -1;
			jas_free(siz->comps);
			return -1;
			jas_free(siz->comps);
			return -1;
			jas_free(siz->comps);
			return -1;
		jas_free(siz->comps);
		return -1;

Fixed code:
	siz->comps = 0;

		goto error;
	if (!siz->width || !siz->height) {
		jas_eprintf("reference grid cannot have zero area\n");
		goto error;
	if (!siz->tilewidth || !siz->tileheight) {
		jas_eprintf("tile cannot have zero area\n");
		goto error;
	}
	if (!siz->numcomps || siz->numcomps > 16384) {
		jas_eprintf("number of components not in permissible range\n");
		goto error;
	if (siz->xoff >= siz->width) {
		jas_eprintf("XOsiz not in permissible range\n");
		goto error;
	}
	if (siz->yoff >= siz->height) {
		jas_eprintf("YOsiz not in permissible range\n");
		goto error;
	}
	if (siz->tilexoff > siz->xoff || siz->tilexoff + siz->tilewidth <= siz->xoff) {
		jas_eprintf("XTOsiz not in permissible range\n");
		goto error;
	}
	if (siz->tileyoff > siz->yoff || siz->tileyoff + siz->tileheight <= siz->yoff) {
		jas_eprintf("YTOsiz not in permissible range\n");
		goto error;
	}

		goto error;
			goto error;
			goto error;
			goto error;
		goto error;

error:
	if (siz->comps) {
		jas_free(siz->comps);
	}
	return -1;
CVE-2016-9394 (C, published 2017-03-23T18:59Z)
Description: value: The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_cs.c
Commit message: Added some missing sanity checks on the data in a SIZ marker segment.


Vulnerable code:
		return -1;
	if (!siz->width || !siz->height || !siz->tilewidth ||
	  !siz->tileheight || !siz->numcomps || siz->numcomps > 16384) {
		return -1;
	if (siz->tilexoff >= siz->width || siz->tileyoff >= siz->height) {
		jas_eprintf("all tiles are outside the image area\n");
		return -1;
		return -1;
			jas_free(siz->comps);
			return -1;
			jas_free(siz->comps);
			return -1;
			jas_free(siz->comps);
			return -1;
		jas_free(siz->comps);
		return -1;

Fixed code:
	siz->comps = 0;

		goto error;
	if (!siz->width || !siz->height) {
		jas_eprintf("reference grid cannot have zero area\n");
		goto error;
	if (!siz->tilewidth || !siz->tileheight) {
		jas_eprintf("tile cannot have zero area\n");
		goto error;
	}
	if (!siz->numcomps || siz->numcomps > 16384) {
		jas_eprintf("number of components not in permissible range\n");
		goto error;
	if (siz->xoff >= siz->width) {
		jas_eprintf("XOsiz not in permissible range\n");
		goto error;
	}
	if (siz->yoff >= siz->height) {
		jas_eprintf("YOsiz not in permissible range\n");
		goto error;
	}
	if (siz->tilexoff > siz->xoff || siz->tilexoff + siz->tilewidth <= siz->xoff) {
		jas_eprintf("XTOsiz not in permissible range\n");
		goto error;
	}
	if (siz->tileyoff > siz->yoff || siz->tileyoff + siz->tileheight <= siz->yoff) {
		jas_eprintf("YTOsiz not in permissible range\n");
		goto error;
	}

		goto error;
			goto error;
			goto error;
			goto error;
		goto error;

error:
	if (siz->comps) {
		jas_free(siz->comps);
	}
	return -1;
CVE-2016-9560 (C, published 2017-02-15T19:59Z)
Description: value: Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_dec.c
Commit message: Fixed an array overflow problem in the JPC decoder.


Vulnerable code:
	jpc_tsfb_band_t bnds[64];

Fixed code:
	jpc_tsfb_band_t bnds[JPC_MAXBANDS];
CVE-2016-9583 (C, published 2018-08-01T17:29Z)
Description: value: An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_t2cod.c
Commit message: Fixed a bug in the packet iterator code.
Added a new regression test case.


Vulnerable code:
				if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
				  pirlvl->prcheightexpn + pi->picomp->numrlvls >

Fixed code:
				if (pirlvl->prcwidthexpn + picomp->numrlvls >
				  pirlvl->prcheightexpn + picomp->numrlvls >
CVE-2017-6850 (C, published 2017-03-15T14:59Z)
Description: value: The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/base/jas_stream.c
src/libjasper/jp2/jp2_cod.c
Commit message: Fixed bugs due to uninitialized data in the JP2 decoder.
Also, added some comments marking I/O stream interfaces that probably
need to be changed (in the long term) to fix integer overflow problems.


Vulnerable code:
jp2_box_t *jp2_box_create(int type)
	jp2_boxinfo_t *boxinfo;

	if (!(box = jas_malloc(sizeof(jp2_box_t)))) {

	// Mark the box data as never having been constructed
	// so that we will not errantly attempt to destroy it later.
	box->ops = &jp2_boxinfo_unk.ops;

	  "preliminary processing of JP2 box: type=%c%s%c (0x%08x); length=%d\n",
		if (jas_stream_copy(out, tmpstream, box->len - JP2_BOX_HDRLEN(false))) {
/* Eliminate warning about unused variable. */
box = 0;
out = 0;

Fixed code:
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
/* FIXME integral type */
jp2_box_t *jp2_box_create0()
	box->type = 0;
	box->len = 0;
	// Mark the box data as never having been constructed
	// so that we will not errantly attempt to destroy it later.
	box->ops = &jp2_boxinfo_unk.ops;
	return box;
}

jp2_box_t *jp2_box_create(int type)
{
	jp2_box_t *box;
	jp2_boxinfo_t *boxinfo;
	if (!(box = jp2_box_create0())) {
		return 0;
	}
	if (!(box = jp2_box_create0())) {
	  "preliminary processing of JP2 box: "
	  "type=%c%s%c (0x%08x); length=%"PRIuFAST32"\n",
		JAS_DBGLOG(10, ("big length\n"));
	bpcc->bpcs = 0;
	cdef->ents = 0;
		if (jas_stream_copy(out, tmpstream, box->len -
		  JP2_BOX_HDRLEN(false))) {
			jas_eprintf("cannot copy box data\n");
	cmap->ents = 0;
	pclr->bpc = 0;
	/* Eliminate warning about unused variable. */
	box = 0;
	out = 0;
CVE-2017-20162 (JavaScript, published 2023-01-05T12:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/vercel/ms
Files changed:
index.js
Commit message: Limit str to 100 to avoid ReDoS of 0.3s (#89)



Vulnerable code:
  if (str.length > 10000) {

Fixed code:
  if (str.length > 100) {
CVE-2018-13423 (PHP, published 2018-07-07T17:29Z)
Description: value: admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/omeka/Omeka
Files changed:
admin/themes/default/items/tag-form.php
admin/themes/default/javascripts/items.js
Commit message: Add escaping for tags on item form


Vulnerable code:
                    <?php echo '<span class="tag">' . $tag->name . '</span>'; 
        tagLi.prepend('<span class="tag">' + tag + '</span>');

Fixed code:
                    <?php echo '<span class="tag">' . html_escape($tag->name) . '</span>';
        $('<span></span>', {'class': 'tag', 'text': tag}).appendTo(tagLi);