hitoshura25/cvefixes huggingface dataset:
CVE-2016-10215 (PHP, published 2017-02-10T07:59Z)
Description: value: An issue was discovered in Fastspot BigTree bigtree-form-builder before 1.2. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP POST parameters passed to a "site/index.php/../../extensions/com.fastspot.form-builder/ajax/redraw-field.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Fastspot/bigtree-form-builder
Files changed:
README.md
ajax/redraw-field.php
classes/btx-form-builder.php
manifest.json
templates/routed/btx-form-builder/default.php
Commit message: 1.2 release, forgot to add release notes in 1.1


Vulnerable code:
	$type = trim($_POST["type"]);
	$key = str_replace("form_builder_element_", "", $_POST["name"]);
<input type="hidden" name="id[<?=$key?>]" value="<?=$_POST["id"]?>" />
<input type="hidden" name="type[<?=$key?>]" value="<?=$type?>" />
		var $Table = "btx_form_builder_forms";
		static $SearchPageCount = false;
	}
    "version": "1.1",
    "revision": 21,
                        "level": "0",

Fixed code:
### 1.2 Release
- Fixed potential XSS attack via redraw-field (thanks to Haojun Hou in ADLab of Venustech)
- Fixed drawing back to back column sets breaking the display

### 1.1 Release
- Auto responder email support
- Fixed limiting entries not showing properly after being checked while editing
- Fixed invalid dates coming through date fields (thanks to Jordan Mason)

	$key = htmlspecialchars(str_replace("form_builder_element_", "", $_POST["name"]));

	// We URLify to prevent any kind of weird include jacking via ../
	$type = BigTreeCMS::urlify(trim($_POST["type"]));
<input type="hidden" name="id[<?=$key?>]" value="<?=htmlspecialchars($_POST["id"])?>" />
<input type="hidden" name="type[<?=$key?>]" value="<?=htmlspecialchars($type)?>" />
		public $Table = "btx_form_builder_forms";

		public static $SearchPageCount = false;
			
					

					
					



	}
    "version": "1.2",
    "revision": 22,
                        "level": "2",

					// Reset so that if someone did back to back columns it draws properly
					$field_type = "second_column";
CVE-2022-4136 (PHP, published 2022-11-24T08:15Z)
Description: value: Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/qmpaas/leadshop
Files changed:
web/leadshop.php
Commit message: fix_rce


Vulnerable code:

Fixed code:
            if($include==="Update")
            //$this->ToMkdir("/web/log.txt", 1, false, true);
            else
            die("检测到非法传参，请登录后台进入更新界面");
            
                    //$this->ToMkdir("/web/log.txt", $version, false, true);
                    //$version = "1.4.14";//test version update
CVE-2021-3119 (Other, published 2021-03-25T23:15Z)
Description: value: Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/sqlcipher/sqlcipher
Files changed:
src/crypto.c
test/sqlcipher-compatibility.test
Commit message: fix sqlcipher_export handling of NULL parameters


Vulnerable code:
  targetDb = (const char*) sqlite3_value_text(argv[0]);
  sourceDb = (argc == 2) ? (char *) sqlite3_value_text(argv[1]) : "main";
  if(targetDb_idx == 0 && sqlite3StrICmp("main", targetDb) != 0) {

Fixed code:
  if(sqlite3_value_type(argv[0]) == SQLITE_NULL) {
    rc = SQLITE_ERROR;
    pzErrMsg = sqlite3_mprintf("target database can't be NULL");
    goto end_of_export;
  }

  targetDb = (const char*) sqlite3_value_text(argv[0]); 
  sourceDb = "main";

  if(argc == 2) {
    if(sqlite3_value_type(argv[1]) == SQLITE_NULL) {
      rc = SQLITE_ERROR;
      pzErrMsg = sqlite3_mprintf("target database can't be NULL");
      goto end_of_export;
    }
    sourceDb = (char *) sqlite3_value_text(argv[1]);
  }

  if(targetDb_idx == 0 && targetDb != NULL && sqlite3StrICmp("main", targetDb) != 0) {
# verify sqlcipher_export with NULL parameters
do_test export-nulls {
  sqlite_orig db test.db

  catchsql {
    SELECT sqlcipher_export(NULL);
  }

} {1 {target database can't be NULL}}
db close
file delete -force test.db

do_test export-nulls {
  sqlite_orig db test.db

  catchsql {
    SELECT sqlcipher_export('main', NULL);
  }

} {1 {target database can't be NULL}}
db close
file delete -force test.db


# use the sqlcipher_export function
CVE-2020-11068 (C, published 2020-06-23T17:15Z)
Description: value: In LoRaMac-node before 4.4.4, a reception buffer overflow can happen due to the received buffer size not being checked. This has been fixed in 4.4.4.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/Lora-net/LoRaMac-node
Files changed:
src/mac/LoRaMac.c
src/peripherals/atecc608a-tnglora-se/atecc608a-tnglora-se.c
src/peripherals/lr1110-se/lr1110-se.c
src/peripherals/soft-se/soft-se.c
Commit message: Added received buffer size checks.


Vulnerable code:
            if( MAX( 0, ( int16_t )( ( int16_t ) size - ( int16_t ) LORA_MAC_FRMPAYLOAD_OVERHEAD ) ) > ( int16_t )phyParam.Value )

Fixed code:
            // Check if the received frame size is valid
            if( size < LORAMAC_JOIN_ACCEPT_FRAME_MIN_SIZE )
            {
                MacCtx.McpsIndication.Status = LORAMAC_EVENT_INFO_STATUS_ERROR;
                PrepareRxDoneAbort( );
                return;
            }
            if( ( MAX( 0, ( int16_t )( ( int16_t ) size - ( int16_t ) LORAMAC_FRAME_PAYLOAD_OVERHEAD_SIZE ) ) > ( int16_t )phyParam.Value ) ||
                ( size < LORAMAC_FRAME_PAYLOAD_MIN_SIZE ) )
    // Check that frame size isn't bigger than a JoinAccept with CFList size
    if( encJoinAcceptSize > LORAMAC_JOIN_ACCEPT_FRAME_MAX_SIZE )
    {
        return SECURE_ELEMENT_ERROR_BUF_SIZE;
    }

    // Check that frame size isn't bigger than a JoinAccept with CFList size
    if( encJoinAcceptSize > LORAMAC_JOIN_ACCEPT_FRAME_MAX_SIZE )
    {
        return SECURE_ELEMENT_ERROR_BUF_SIZE;
    }

    // Check that frame size isn't bigger than a JoinAccept with CFList size
    if( encJoinAcceptSize > LORAMAC_JOIN_ACCEPT_FRAME_MAX_SIZE )
    {
        return SECURE_ELEMENT_ERROR_BUF_SIZE;
    }
CVE-2022-39274 (C, published 2022-10-06T18:16Z)
Description: value: LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable to a buffer overflow. Improper size validation of the incoming radio frames can lead to an 65280-byte out-of-bounds write. The function `ProcessRadioRxDone` implicitly expects incoming radio frames to have at least a payload of one byte or more. An empty payload leads to a 1-byte out-of-bounds read of user controlled content when the payload buffer is reused. This allows an attacker to craft a FRAME_TYPE_PROPRIETARY frame with size -1 which results in an 65280-byte out-of-bounds memcopy likely with partially controlled attacker data. Corrupting a large part if the data section is likely to cause a DoS. If the large out-of-bounds write does not immediately crash the attacker may gain control over the execution due to now controlling large parts of the data section. Users are advised to upgrade either by updating their package or by manually applying the patch commit `e851b079`.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/Lora-net/LoRaMac-node
Files changed:
src/mac/LoRaMac.c
Commit message: Fixed potential buffer overflow in `ProcessRadioRxDone`


Vulnerable code:

Fixed code:
    // Abort on empty radio frames
    if( size == 0 )
    {
        MacCtx.McpsIndication.Status = LORAMAC_EVENT_INFO_STATUS_ERROR;
        PrepareRxDoneAbort( );
        return;
    }
CVE-2014-3985 (C, published 2014-09-11T18:55Z)
Description: value: The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpc/Changelog.txt
miniupnpc/miniwget.c
Commit message: miniwget.c: fixed potential buffer overrun


Vulnerable code:
					while(header_buf[i]=='\r' || header_buf[i] == '\n')

Fixed code:
2013/10/07:
  fixed potential buffer overrun in miniwget.c

					while((i < (int)header_buf_used) && (header_buf[i]=='\r' || header_buf[i] == '\n'))
CVE-2015-6031 (C, published 2015-11-02T19:59Z)
Description: value: Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpc/igd_desc_parse.c
Commit message: igd_desc_parse.c: fix buffer overflow


Vulnerable code:
/* $Id: igd_desc_parse.c,v 1.16 2014/11/17 17:19:13 nanard Exp $ */
 * Copyright (c) 2005-2014 Thomas Bernard
	memcpy( datas->cureltname, name, l);

Fixed code:
/* $Id: igd_desc_parse.c,v 1.17 2015/09/15 13:30:04 nanard Exp $ */
 * Copyright (c) 2005-2015 Thomas Bernard
	if(l >= MINIUPNPC_URL_MAXSIZE)
		l = MINIUPNPC_URL_MAXSIZE-1;
	memcpy(datas->cureltname, name, l);
CVE-2016-3178 (C, published 2017-03-24T15:59Z)
Description: value: The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (out-of-bounds memory access and daemon crash) via vectors involving a negative length value.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
minissdpd/Changelog.txt
minissdpd/minissdpd.c
minissdpd/testminissdpd.c
Commit message: minissdpd: Fix broken overflow test (p+l > buf+n) thanks to Salva Piero


Vulnerable code:
$Id: Changelog.txt,v 1.43 2015/08/06 14:05:49 nanard Exp $
/* $Id: minissdpd.c,v 1.50 2015/08/06 14:05:49 nanard Exp $ */
	if(p+l > buf+n) {
		if(p+l > buf+n) {
		if(p+l > buf+n) {
		if(p+l > buf+n) {
/* $Id: testminissdpd.c,v 1.12 2015/08/06 13:16:59 nanard Exp $ */

Fixed code:
$Id: Changelog.txt,v 1.45 2016/03/01 18:06:46 nanard Exp $

2016/03/01:
	Fix broken overflow test (p+l > buf+n) thanks to Salva Piero
/* $Id: minissdpd.c,v 1.53 2016/03/01 18:06:46 nanard Exp $ */
	if(l > (unsigned)(buf+n-p)) {
		if(l > (unsigned)(buf+n-p)) {
		if(l > (unsigned)(buf+n-p)) {
		if(l > (unsigned)(buf+n-p)) {
/* $Id: testminissdpd.c,v 1.14 2016/03/01 17:49:51 nanard Exp $ */
	const char bad_command4[] = { 0x04, 0x01, 0x60, 0x8f, 0xff, 0xff, 0xff, 0x7f};
	if(n == 0) {
		close(s);
		s = connect_unix_socket(sockpath);
	}

	n = SENDCOMMAND(bad_command4, sizeof(bad_command4));
	n = read(s, buf, sizeof(buf));
	printf("Response received %d bytes\n", (int)n);
	printresponse(buf, n);
CVE-2016-3179 (C, published 2017-03-24T15:59Z)
Description: value: The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (invalid free and daemon crash) via vectors related to error handling.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
minissdpd/minissdpd.c
Commit message: minissdpd.c: Initialize pointers to NULL (fix)


Vulnerable code:

Fixed code:
		memset(newserv, 0, sizeof(struct service));	/* set pointers to NULL */
CVE-2017-1000494 (C, published 2018-01-03T14:29Z)
Description: value: Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpc/upnpreplyparse.c
miniupnpd/upnpreplyparse.c
Commit message: properly initialize data structure for SOAP parsing in ParseNameValue()

topelt field was not properly initialized.

should fix #268


Vulnerable code:
/* MiniUPnP project
 * (c) 2006-2015 Thomas Bernard
	data->l_head = NULL;
	data->portListing = NULL;
	data->portListingLength = 0;
/* MiniUPnP project
 * (c) 2006-2015 Thomas Bernard
	data->l_head = NULL;
	data->portListing = NULL;
	data->portListingLength = 0;

Fixed code:
/* vim: tabstop=4 shiftwidth=4 noexpandtab
 * MiniUPnP project
 * (c) 2006-2017 Thomas Bernard
	memset(data, 0, sizeof(struct NameValueParserData));
/* vim: tabstop=4 shiftwidth=4 noexpandtab
 * MiniUPnP project
 * (c) 2006-2017 Thomas Bernard
	memset(data, 0, sizeof(struct NameValueParserData));
CVE-2019-12106 (C, published 2019-05-15T23:29Z)
Description: value: The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
minissdpd/minissdpd.c
Commit message: updateDevice() remove element from the list when realloc fails


Vulnerable code:

Fixed code:
					*pp = p->next;	/* remove "p" from the list */
CVE-2019-12107 (C, published 2019-05-15T23:29Z)
Description: value: The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper validation of an snprintf return value.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpd/upnpevents.c
Commit message: upnp_event_prepare(): check the return value of snprintf()


Vulnerable code:
	obj->buffer = malloc(obj->buffersize);
	if(!obj->buffer) {
		syslog(LOG_ERR, "%s: malloc returned NULL", "upnp_event_prepare");
		if(xml) {
			free(xml);
		obj->state = EError;
		return;
	obj->tosend = snprintf(obj->buffer, obj->buffersize, notifymsg,
	                       obj->path, obj->addrstr, obj->portstr, l+2,
	                       obj->sub->uuid, obj->sub->seq,
	                       l, xml);

Fixed code:
	for (;;) {
		obj->buffer = malloc(obj->buffersize);
		if(!obj->buffer) {
			syslog(LOG_ERR, "%s: malloc returned NULL", "upnp_event_prepare");
			if(xml) {
				free(xml);
			}
			obj->state = EError;
			return;
		obj->tosend = snprintf(obj->buffer, obj->buffersize, notifymsg,
		                       obj->path, obj->addrstr, obj->portstr, l+2,
		                       obj->sub->uuid, obj->sub->seq,
		                       l, xml);
		if (obj->tosend < 0) {
			syslog(LOG_ERR, "%s: snprintf() failed", "upnp_event_prepare");
			if(xml) {
				free(xml);
			}
			obj->state = EError;
			return;
		} else if (obj->tosend < obj->buffersize) {
			break; /* the buffer was large enough */
		}
		/* Try again with a buffer big enough */
		free(obj->buffer);
		obj->buffersize = obj->tosend + 1;	/* reserve space for the final 0 */
CVE-2019-12108 (C, published 2019-05-15T23:29Z)
Description: value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for int_port.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpd/upnpsoap.c
Commit message: fix error from commit 13585f15c7f7dc28bbbba1661efb280d530d114c


Vulnerable code:
	if (!int_port || !ext_port || !protocol)

Fixed code:
	if (!int_port || !rem_port || !protocol)
CVE-2019-12108 (C, published 2019-05-15T23:29Z)
Description: value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for int_port.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpd/upnpsoap.c
Commit message: GetOutboundPinholeTimeout: check args


Vulnerable code:

Fixed code:
	if (!int_port || !ext_port || !protocol)
	{
		ClearNameValueList(&data);
		SoapError(h, 402, "Invalid Args");
		return;
	}
CVE-2019-12109 (C, published 2019-05-15T23:29Z)
Description: value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for rem_port.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpd/upnpsoap.c
Commit message: fix error from commit 13585f15c7f7dc28bbbba1661efb280d530d114c


Vulnerable code:
	if (!int_port || !ext_port || !protocol)

Fixed code:
	if (!int_port || !rem_port || !protocol)
CVE-2019-12109 (C, published 2019-05-15T23:29Z)
Description: value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for rem_port.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpd/upnpsoap.c
Commit message: GetOutboundPinholeTimeout: check args


Vulnerable code:

Fixed code:
	if (!int_port || !ext_port || !protocol)
	{
		ClearNameValueList(&data);
		SoapError(h, 402, "Invalid Args");
		return;
	}
CVE-2019-12110 (C, published 2019-05-15T23:29Z)
Description: value: An AddPortMapping Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in upnpredirect.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpd/upnpredirect.c
Commit message: upnp_redirect(): accept NULL desc argument


Vulnerable code:

Fixed code:

	if (desc == NULL)
		desc = "";	/* assume empty description */
CVE-2019-12111 (C, published 2019-05-15T23:29Z)
Description: value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in copyIPv6IfDifferent in pcpserver.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/miniupnp/miniupnp
Files changed:
miniupnpd/pcpserver.c
Commit message: pcpserver.c: copyIPv6IfDifferent() check for NULL src argument


Vulnerable code:
	if(dest != src) {

Fixed code:
	if(dest != src && src != NULL) {
CVE-2023-0398 (Unknown, published 2023-01-19T09:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/modoboa/modoboa
Files changed:
Commit message: Merge pull request #2752 from modoboa/fix/delete_domain_post

Enforce POST methods for delete domain view.

Vulnerable code:

Fixed code:
CVE-2023-0406 (Python, published 2023-01-19T18:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/modoboa/modoboa
Files changed:
modoboa/admin/views/identity.py
Commit message: Enforce POST method for account delete view


Vulnerable code:

Fixed code:
from django.views.decorators.http import require_http_methods
@require_http_methods(["POST"])