hitoshura25/cvefixes huggingface dataset:
CVE-2022-0370 (PHP, published 2022-01-27T06:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/js/admintheme.form.angular.js
lhc_web/design/defaulttheme/tpl/lhkernel/validation_error.tpl.php
lhc_web/design/defaulttheme/tpl/lhtheme/admin/form.tpl.php
lhc_web/design/defaulttheme/tpl/lhtheme/personaltheme.tpl.php
Commit message: CSRF For personal theme


Vulnerable code:
<div data-alert class="alert alert-danger alert-dismissible fade show">
<div role="tabpanel" ng-controller="IClickToCallFormGenerator as cform"  ng-init='<?php if ($form->static_content != '') : ?>cform.staticResources = <?php echo $form->static_content?>;<?php endif;?><?php if ($form->static_js_content != '') : ?>cform.staticJSResources = <?php echo $form->static_js_content?>;<?php endif;?><?php if ($form->static_css_content != '') : ?>cform.staticCSSResources = <?php echo $form->static_css_content?>;<?php endif;?>'>
        <label><input type="checkbox" name="EnabledPersonal" value="on" <?php if ($enabledPersonal == true) : ?>checked="checked"<?php endif;?> /> Enable personal theme for me</label>

Fixed code:

        this.initVariables = function () {
            if (window.PersonalTheme.staticResources) {
                this.staticResources = window.PersonalTheme.staticResources;
            }
            if (window.PersonalTheme.staticJSResources) {
                this.staticJSResources = window.PersonalTheme.staticJSResources;
            }
            if (window.PersonalTheme.staticCSSResources) {
                this.staticCSSResources = window.PersonalTheme.staticCSSResources;
            }
        }
<div data-alert class="alert alert-danger alert-dismissible fade show" ng-non-bindable>
<script>
    window.PersonalTheme = {};

    <?php if ($form->static_content != '') : ?>
    window.PersonalTheme.staticResources = <?php echo $form->static_content;?>
    <?php endif; ?>

    <?php if ($form->static_js_content != '') : ?>
    window.PersonalTheme.staticJSResources = <?php echo $form->static_js_content;?>
    <?php endif; ?>

    <?php if ($form->static_css_content != '') : ?>
    window.PersonalTheme.staticCSSResources = <?php echo $form->static_css_content;?>
    <?php endif; ?>
</script>

<div role="tabpanel" ng-controller="IClickToCallFormGenerator as cform" ng-init="cform.initVariables();">
        <label><input type="checkbox" name="EnabledPersonal" value="on" <?php if ($enabledPersonal == true) : ?>checked="checked"<?php endif;?> /> <?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('admintheme/form','Enable personal theme for me');?></label>
CVE-2022-0387 (PHP, published 2022-01-27T06:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhdepartment/editgroup.tpl.php
lhc_web/design/defaulttheme/tpl/lhdepartment/editlimitgroup.tpl.php
lhc_web/design/defaulttheme/tpl/lhdepartment/newgroup.tpl.php
Commit message: fix


Vulnerable code:
<h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('department/edit','Edit department group');?> - <?php echo htmlspecialchars($departament_group->name)?></h1>
<h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('department/edit','Edit department limit group');?> - <?php echo htmlspecialchars($departament_group->name)?></h1>
<form action="<?php echo erLhcoreClassDesign::baseurl('department/newgroup')?>" method="post">

Fixed code:
<h1 ng-non-bindable><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('department/edit','Edit department group');?> - <?php echo htmlspecialchars($departament_group->name)?></h1>
<h1 ng-non-bindable><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('department/edit','Edit department limit group');?> - <?php echo htmlspecialchars($departament_group->name)?></h1>
<form action="<?php echo erLhcoreClassDesign::baseurl('department/newgroup')?>" method="post" ng-non-bindable>
CVE-2022-0394 (PHP, published 2022-01-28T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhfaq/embedcode.tpl.php
lhc_web/design/defaulttheme/tpl/lhfaq/htmlcode.tpl.php
lhc_web/design/defaulttheme/tpl/lhquestionary/embedcode.tpl.php
Commit message: Escape for angular in embed pages


Vulnerable code:
<div class="row">
<div class="row">
        <select class="form-control" id="LocaleID">
        <select class="form-control" id="ThemeID">

Fixed code:
<div class="row" ng-non-bindable>
<div class="row" ng-non-bindable>
        <select class="form-control" id="LocaleID" ng-non-bindable>
        <select class="form-control" id="ThemeID" ng-non-bindable>
CVE-2022-0395 (PHP, published 2022-01-28T22:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
Commit message: Escape in user box


Vulnerable code:
    <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false"><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>

Fixed code:
    <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false" ng-non-bindable><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>
CVE-2022-0502 (PHP, published 2022-02-06T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgform.tpl.php
lhc_web/design/defaulttheme/tpl/lhuser/parts/canned_messages.tpl.php
Commit message: Canned messages fixes


Vulnerable code:
<div id="canned-controller" ng-controller="CannedMsgCtrl as cmsg" ng-cloak ng-init='cmsg.initController()<?php if ($canned_message->languages != '') : ?>cmsg.initLanguage(<?php echo $canned_message->id?>);<?php endif;?>'>
<form ng-controller="CannedMsgCtrl as cmsg" ng-init='cmsg.iniController();<?php if ($canned_msg->languages != '') : ?>cmsg.initLanguage(<?php echo ($canned_msg->id > 0 ? $canned_msg->id : 0)?>);<?php endif;?>' action="<?php if ($canned_msg->id > 0) : ?><?php echo erLhcoreClassDesign::baseurl('user/account')?>/(tab)/canned/(msg)/<?php echo $canned_msg->id?><?php endif;?>#canned" method="post">
                        <textarea class="form-control" rows="5" name="Message" id="canned-message"><?php echo htmlspecialchars($canned_msg->msg);?></textarea>
                        <textarea class="form-control" rows="5" name="FallbackMessage" id="id-FallbackMessage"><?php echo htmlspecialchars($canned_msg->fallback_msg);?></textarea>

Fixed code:
<div id="canned-controller" ng-controller="CannedMsgCtrl as cmsg" ng-cloak ng-init='cmsg.initController();<?php if ($canned_message->languages != '') : ?>cmsg.initLanguage(<?php echo $canned_message->id?>);<?php endif;?>'>
<form ng-controller="CannedMsgCtrl as cmsg" ng-init='cmsg.initController();<?php if ($canned_msg->languages != '') : ?>cmsg.initLanguage(<?php echo ($canned_msg->id > 0 ? $canned_msg->id : 0)?>);<?php endif;?>' action="<?php if ($canned_msg->id > 0) : ?><?php echo erLhcoreClassDesign::baseurl('user/account')?>/(tab)/canned/(msg)/<?php echo $canned_msg->id?><?php endif;?>#canned" method="post">
                        <textarea class="form-control" ng-non-bindable rows="5" name="Message" id="canned-message"><?php echo htmlspecialchars($canned_msg->msg);?></textarea>
                        <textarea class="form-control" ng-non-bindable rows="5" name="FallbackMessage" id="id-FallbackMessage"><?php echo htmlspecialchars($canned_msg->fallback_msg);?></textarea>
CVE-2022-1176 (PHP, published 2022-03-31T10:15Z)
Description: value: Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/modules/lhwidgetrestapi/addmsguser.php
lhc_web/modules/lhwidgetrestapi/fetchmessage.php
lhc_web/modules/lhwidgetrestapi/fetchmessages.php
lhc_web/modules/lhwidgetrestapi/getmessagesnippet.php
lhc_web/modules/lhwidgetrestapi/initchat.php
lhc_web/modules/lhwidgetrestapi/sendmailsettings.php
lhc_web/modules/lhwidgetrestapi/uisettings.php
Commit message: Type check


Vulnerable code:
        if ($chat->hash == $payload['hash'] && (in_array($chat->status,$validStatuses)) && !in_array($chat->status_sub, array(erLhcoreClassModelChat::STATUS_SUB_SURVEY_COMPLETED, erLhcoreClassModelChat::STATUS_SUB_USER_CLOSED_CHAT, erLhcoreClassModelChat::STATUS_SUB_SURVEY_SHOW, erLhcoreClassModelChat::STATUS_SUB_CONTACT_FORM))) // Allow add messages only if chat is active
    if ($chat instanceof erLhcoreClassModelChat && $chat->hash == $requestPayload['hash'])
if (is_object($chat) && $chat->hash == $requestPayload['hash'])
    if ($chat instanceof erLhcoreClassModelChat && $chat->hash == $requestPayload['hash'])
    if ($chat->hash == $requestPayload['hash'])
if ($chat instanceof erLhcoreClassModelChat && $chat->hash == $Params['user_parameters']['hash'])
    if ($chat->hash == $requestPayload['hash'])

Fixed code:
        if ($chat->hash === $payload['hash'] && (in_array($chat->status,$validStatuses)) && !in_array($chat->status_sub, array(erLhcoreClassModelChat::STATUS_SUB_SURVEY_COMPLETED, erLhcoreClassModelChat::STATUS_SUB_USER_CLOSED_CHAT, erLhcoreClassModelChat::STATUS_SUB_SURVEY_SHOW, erLhcoreClassModelChat::STATUS_SUB_CONTACT_FORM))) // Allow add messages only if chat is active
    if ($chat instanceof erLhcoreClassModelChat && $chat->hash === $requestPayload['hash'])
if (is_object($chat) && $chat->hash === $requestPayload['hash'])
    if ($chat instanceof erLhcoreClassModelChat && $chat->hash === $requestPayload['hash'])
    if ($chat->hash === $requestPayload['hash'])
if ($chat instanceof erLhcoreClassModelChat && $chat->hash === $Params['user_parameters']['hash'])
    if ($chat->hash === $requestPayload['hash'])
CVE-2022-1191 (PHP, published 2022-03-31T09:15Z)
Description: value: SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/modules/lhcobrowse/proxycss.php
Commit message: Harden to avoid SSRF


Vulnerable code:
    $ch = curl_init();
        
   
    } else { 
    
    $cssContent = curl_exec($ch);

Fixed code:
// Only http/https supported
if (!in_array($url['scheme'],['http','https']) || (isset($url['port']) && !in_array($url['port'],[80,443]))) {
    exit;
}



    } else {

        if (!in_array($urlCSS['scheme'],['http','https']) || (isset($urlCSS['port']) && !in_array($urlCSS['port'],[80,443]))) {
            exit;
        }


    $ch = curl_init();
    curl_setopt($ch, CURLOPT_HEADER, true);
    $response = curl_exec($ch);

    if (curl_errno($ch)) {   // should be 0
        curl_close($ch);
        exit;
    }

    $curl_info = curl_getinfo($ch);
    $contentType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
    $header_size = $curl_info['header_size'];

    $cssContent = substr($response, $header_size);

    if ($contentType != 'text/css') {
        exit;
    }
CVE-2022-1213 (PHP, published 2022-04-05T04:15Z)
Description: value: SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/modules/lhcobrowse/proxycss.php
Commit message: fix #1752


Vulnerable code:
$url = parse_url($_GET['base']);
        if (!in_array($urlCSS['scheme'],['http','https']) || (isset($urlCSS['port']) && !in_array($urlCSS['port'],[80,443]))) {

Fixed code:
$base = trim($_GET['base']);

if (!filter_var($base, FILTER_VALIDATE_URL)) {
    exit;
}

$url = parse_url($base);
        if (!filter_var($_GET['css'], FILTER_VALIDATE_URL) || !in_array($urlCSS['scheme'],['http','https']) || (isset($urlCSS['port']) && !in_array($urlCSS['port'],[80,443]))) {
CVE-2022-1234 (PHP, published 2022-04-06T04:15Z)
Description: value: XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/modules/lhcannedmsg/showsuggester.php
lhc_web/modules/lhcannedmsg/subject.php
lhc_web/modules/lhchat/blockuser.php
lhc_web/modules/lhchat/changestatus.php
lhc_web/modules/lhchat/checkchatstatus.php
lhc_web/modules/lhchat/editprevious.php
lhc_web/modules/lhchat/getmessageadmin.php
lhc_web/modules/lhchat/holdaction.php
lhc_web/modules/lhcobrowse/checkinitializer.php
lhc_web/modules/lhcobrowse/checkmirrorchanges.php
lhc_web/modules/lhuser/setinactive.php
lhc_web/modules/lhxml/accepttransfer.php
lhc_web/modules/lhxml/accepttransferbychat.php
lhc_web/modules/lhxml/chatdata.php
lhc_web/modules/lhxml/chatssynchro.php
lhc_web/modules/lhxml/checklogin.php
lhc_web/modules/lhxml/getuseronlinestatus.php
lhc_web/modules/lhxml/transferchat.php
lhc_web/modules/lhxml/userinfo.php
Commit message: Add missing applicaiton/json header where missing


Vulnerable code:
            
<?php 
<?php 

Fixed code:
header('Content-type: application/json');

        header('Content-type: application/json');
    header('Content-type: application/json');
    header('Content-type: application/json');
            header('Content-type: application/json');

            header('Content-type: application/json');

            header('Content-type: application/json');
header('Content-type: application/json');

<?php

header('Content-type: application/json');
header('Content-type: application/json');

header('Content-type: application/json');

<?php
header('Content-type: application/json');
header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');


header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');

header('Content-type: application/json');
CVE-2022-1235 (PHP, published 2022-04-05T07:15Z)
Description: value: Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-916 \u2014 Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/cli/lib/install.php
lhc_web/modules/lhcaptcha/captchastring.php
lhc_web/modules/lhinstall/install.php
Commit message: Increase size of secret hash and chagne it's algorithm


Vulnerable code:
            $cfgSite->setSetting( 'site', 'secrethash', substr(md5(time() . ":" . mt_rand()),0,10));
$hash = sha1(erLhcoreClassIPDetect::getIP().$Params['user_parameters']['timets'].erConfigClassLhConfig::getInstance()->getSetting( 'site', 'secrethash' ));
                $cfgSite->setSetting( 'site', 'secrethash', (!empty(getenv('LHC_SECRET_HASH')) ? getenv('LHC_SECRET_HASH') : substr(md5(time() . ":" . mt_rand()),0,10)));

Fixed code:
            $cfgSite->setSetting( 'site', 'secrethash', erLhcoreClassChat::generateHash(80));
$hash = sha1(erLhcoreClassIPDetect::getIP() . $Params['user_parameters']['timets'] . erConfigClassLhConfig::getInstance()->getSetting( 'site', 'secrethash' ));
                $cfgSite->setSetting( 'site', 'secrethash', (!empty(getenv('LHC_SECRET_HASH')) ? getenv('LHC_SECRET_HASH') : erLhcoreClassChat::generateHash(80)));
CVE-2023-26103 (JavaScript, published 2023-02-25T05:15Z)
Description: value: Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/denoland/deno
Files changed:
ext/http/01_http.js
Commit message: refactor(ext/http): use `String.prototype.trim()` instead of regex (#17722)



Vulnerable code:
      StringPrototypeSplit(upgrade, /\s*,\s*/),
      (option) => StringPrototypeToLowerCase(option) === "websocket",
      StringPrototypeSplit(connection, /\s*,\s*/),
      (option) => StringPrototypeToLowerCase(option) === "upgrade",

Fixed code:
  StringPrototypeTrim,
      StringPrototypeSplit(upgrade, ","),
      (option) =>
        StringPrototypeToLowerCase(StringPrototypeTrim(option)) === "websocket",
      StringPrototypeSplit(connection, ","),
      (option) =>
        StringPrototypeToLowerCase(StringPrototypeTrim(option)) === "upgrade",
CVE-2017-1002150 (Python, published 2017-09-14T13:29Z)
Description: value: python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/fedora-infra/python-fedora
Files changed:
fedora/tg/utils.py
Commit message: Disable covert redirects and CSRF token leaking

This disallows the url() function from returning any remote URLs.
This prevents covert redirects, and also prevents us from leaking
CSRF tokens to outside parties.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>


Vulnerable code:

Fixed code:
    if not tgpath.startswith('/'):
        # Do not allow the url() function to be used for external urls.
        # This function is primarily used in redirect() calls, so this prevents
        # covert redirects and thus CSRF leaking.
        tgpath = '/'
CVE-2022-4087 (C, published 2022-11-21T07:15Z)
Description: value: A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through discrepancy. The name of the patch is 186306d6199096b7a7c4b4574d4be8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/ipxe/ipxe
Files changed:
src/net/tls.c
Commit message: [tls] Treat invalid block padding as zero length padding

Harden against padding oracle attacks by treating invalid block
padding as zero length padding, thereby deferring the failure until
after computing the (incorrect) MAC.

Signed-off-by: Michael Brown <mcb30@ipxe.org>


Vulnerable code:
			rc = pad_len;
			return rc;

Fixed code:
			/* Assume zero padding length to avoid timing attacks */
			pad_len = 0;
CVE-2020-36569 (Unknown, published 2022-12-27T22:15Z)
Description: value: Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/nanobox-io/golang-nanoauth
Files changed:
Commit message: Merge pull request #5 from bouk/constant-time-compare

Small security fixes

Vulnerable code:

Fixed code: