hitoshura25/cvefixes huggingface dataset:
CVE-2023-28843 (PHP, published 2023-03-31T18:15Z)
Description: value: PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support. A SQL injection vulnerability found in the PrestaShop paypal module from release from 3.12.0 to and including 3.16.3 allow a remote attacker to gain privileges, modify data, and potentially affect system availability. The cause of this issue is that SQL queries were being constructed with user input which had not been properly filtered. Only deployments on PrestaShop 1.6 are affected. Users are advised to upgrade to module version 3.16.4. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/202ecommerce/paypal
Files changed:
ipn.php
paypal.php
Commit message: refs #36741


Vulnerable code:
    Db::getInstance()->insert('paypal_hss_email_error', array('id_cart' => $custom['id_cart'], 'email' => Tools::getValue('receiver_email')));
                Db::getInstance()->delete('paypal_hss_email_error', 'email = "'.$new_hss_email.'"');

Fixed code:
    Db::getInstance()->insert('paypal_hss_email_error', array('id_cart' => (int) $custom['id_cart'], 'email' => pSQL(Tools::getValue('receiver_email', ''))));
                Db::getInstance()->delete('paypal_hss_email_error', 'email = "'. pSQL($new_hss_email) .'"');
CVE-2021-41556 (C++, published 2022-07-28T21:15Z)
Description: value: sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.
Severity: nan (CVSS v3 base score: 10)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/albertodemichelis/squirrel
Files changed:
squirrel/sqclass.cpp
squirrel/sqclass.h
Commit message: check max member count in class


Vulnerable code:

Fixed code:
	if (_members->CountUsed() >= MEMBER_MAX_COUNT) {
		return false;
	}
#define MEMBER_MAX_COUNT 0x00FFFFFF
CVE-2022-30292 (C++, published 2022-05-04T23:15Z)
Description: value: Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/albertodemichelis/squirrel
Files changed:
squirrel/sqbaselib.cpp
Commit message: fix in thread.call


Vulnerable code:

Fixed code:
        sq_reservestack(_thread(o), nparams + 3);
CVE-2022-23472 (Unknown, published 2022-12-06T18:15Z)
Description: value: Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-338 \u2014 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
Repository: https://github.com/ArjunSharda/Passeo
Files changed:
Commit message: Merge pull request #4 from ArjunSharda/randomlibcriticalpatch

Security patch + quickgen command

Vulnerable code:

Fixed code:
CVE-2021-29621 (Python, published 2021-06-07T19:15Z)
Description: value: Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/dpgaspar/Flask-AppBuilder
Files changed:
flask_appbuilder/security/manager.py
Commit message: fix: auth balance (#1634)



Vulnerable code:

Fixed code:
            # Balance failure and success
            check_password_hash(
                "pbkdf2:sha256:150000$Z3t6fmj2$22da622d94a1f8118"
                "c0976a03d2f18f680bfff877c9a965db9eedc51bc0be87c",
                "password",
            )
CVE-2024-27083 (HTML, published 2024-02-29T01:44Z)
Description: value: Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dpgaspar/Flask-AppBuilder
Files changed:
flask_appbuilder/templates/appbuilder/general/security/login_oauth.html
Commit message: fix: Make sure user input is not treated as safe in the oauth view (#1978)

Co-authored-by: Glenn Schuurman <glenn.schuurman@rabobank.nl>
Co-authored-by: Daniel Vaz Gaspar <danielvazgaspar@gmail.com>

Vulnerable code:
    var next = "?next=" + encodeURIComponent("{{request.args.get('next', '') | safe}}");

Fixed code:
    var next = "?next=" + encodeURIComponent("{{request.args.get('next', '')}}");
CVE-2020-29367 (C, published 2020-11-27T20:15Z)
Description: value: blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Blosc/c-blosc2
Files changed:
blosc/blosc2.c
Commit message: Fixed asan heap buffer overflow when not enough space to write compressed block size.


Vulnerable code:
                   int32_t leftoverblock, int32_t ntbytes, int32_t maxbytes,
    if (ntbytes + maxout > maxbytes) {
      maxout = (int64_t)maxbytes - (int64_t)ntbytes;
        if ((ntbytes + neblock) > maxbytes) {

Fixed code:
                   int32_t leftoverblock, int32_t ntbytes, int32_t destsize,
      if (ntbytes > destsize) {
        /* Not enough space to write out compressed block size */
        return -1;
      }
    if (ntbytes + maxout > destsize) {
      maxout = (int64_t)destsize - (int64_t)ntbytes;
        if ((ntbytes + neblock) > destsize) {
CVE-2023-37185 (C, published 2023-12-25T07:15Z)
Description: value: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/Blosc/c-blosc2
Files changed:
plugins/codecs/zfp/blosc2-zfp.c
Commit message: Fix for #519 #520 #521


Vulnerable code:

Fixed code:
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
CVE-2023-37186 (C, published 2023-12-25T07:15Z)
Description: value: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/Blosc/c-blosc2
Files changed:
plugins/codecs/ndlz/ndlz4x4.c
plugins/codecs/ndlz/ndlz8x8.c
Commit message: Fix #522


Vulnerable code:
  if (NDLZ_UNEXPECT_CONDITIONAL(output_len < (int32_t) (blockshape[0] * blockshape[1]))) {

  if (NDLZ_UNEXPECT_CONDITIONAL(output_len < blockshape[0] * blockshape[1])) {

Fixed code:
  BLOSC_ERROR_NULL(cparams, BLOSC2_ERROR_NULL_POINTER);
  BLOSC_ERROR_NULL(cparams->schunk, BLOSC2_ERROR_NULL_POINTER);
  BLOSC_ERROR_NULL(input, BLOSC2_ERROR_NULL_POINTER);
  BLOSC_ERROR_NULL(output, BLOSC2_ERROR_NULL_POINTER);
  if (NDLZ_UNEXPECT_CONDITIONAL((int64_t)output_len < (int64_t)blockshape[0] * (int64_t)blockshape[1])) {
  BLOSC_ERROR_NULL(cparams, BLOSC2_ERROR_NULL_POINTER);
  BLOSC_ERROR_NULL(cparams->schunk, BLOSC2_ERROR_NULL_POINTER);
  BLOSC_ERROR_NULL(input, BLOSC2_ERROR_NULL_POINTER);
  BLOSC_ERROR_NULL(output, BLOSC2_ERROR_NULL_POINTER);
  if (NDLZ_UNEXPECT_CONDITIONAL((int64_t)output_len < (int64_t)blockshape[0] * (int64_t)blockshape[1])) {
CVE-2023-37187 (C, published 2023-12-25T07:15Z)
Description: value: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/Blosc/c-blosc2
Files changed:
plugins/codecs/zfp/blosc2-zfp.c
Commit message: Fix for #519 #520 #521


Vulnerable code:

Fixed code:
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
CVE-2023-37188 (C, published 2023-12-25T07:15Z)
Description: value: C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/Blosc/c-blosc2
Files changed:
plugins/codecs/zfp/blosc2-zfp.c
Commit message: Fix for #519 #520 #521


Vulnerable code:

Fixed code:
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
  ZFP_ERROR_NULL(cparams->schunk);
  ZFP_ERROR_NULL(dparams->schunk);
CVE-2022-48620 (C, published 2024-01-12T04:15Z)
Description: value: uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/troglobit/libuev
Files changed:
src/uev.c
Commit message: Fix #27: possible buffer overrun in uev_run()

If uev_init1() is called with maxevents > 10 the call to epoll_wait()
might cause buffer overflow.  Reported by Steve Palmer.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>


Vulnerable code:
 * @param maxevents Maximum number of events in event cache
 * argument, which controls the number of events in the event cache
 * returned to the main loop.
		while ((nfds = epoll_wait(ctx->fd, ee, ctx->maxevents, timeout)) < 0) {

Fixed code:
 * @param maxevents Maximum number of events in event cache [1, 10]
 * argument, max ::UEV_MAX_EVENTS, which controls the number of events
 * in the event cache returned to the main loop.
	if (maxevents > UEV_MAX_EVENTS)
		maxevents = UEV_MAX_EVENTS;

		int maxevents = ctx->maxevents;
		if (maxevents > UEV_MAX_EVENTS)
			maxevents = UEV_MAX_EVENTS;

		while ((nfds = epoll_wait(ctx->fd, ee, maxevents, timeout)) < 0) {
CVE-2018-18836 (C, published 2019-06-18T16:15Z)
Description: value: An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/netdata/netdata
Files changed:
libnetdata/url/url.c
web/api/web_api_v1.c
Commit message: fixed vulnerabilities identified by red4sec.com (#4521)



Vulnerable code:
                *d++ = from_hex(s[1]) << 4 | from_hex(s[2]);

Fixed code:
                char t = from_hex(s[1]) << 4 | from_hex(s[2]);
                // avoid HTTP header injection
                *d++ = (char)((isprint(t))? t : ' ');
void fix_google_param(char *s) {
    if(unlikely(!s)) return;

    for( ; *s ;s++) {
        if(!isalnum(*s) && *s != '.' && *s != '_' && *s != '-')
            *s = '_';
    }
}

    // validate the google parameters given
    fix_google_param(google_out);
    fix_google_param(google_sig);
    fix_google_param(google_reqId);
    fix_google_param(google_version);
    fix_google_param(responseHandler);
    fix_google_param(outFileName);
CVE-2018-18837 (C, published 2019-06-18T16:15Z)
Description: value: An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-113 \u2014 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
Repository: https://github.com/netdata/netdata
Files changed:
libnetdata/url/url.c
web/api/web_api_v1.c
Commit message: fixed vulnerabilities identified by red4sec.com (#4521)



Vulnerable code:
                *d++ = from_hex(s[1]) << 4 | from_hex(s[2]);

Fixed code:
                char t = from_hex(s[1]) << 4 | from_hex(s[2]);
                // avoid HTTP header injection
                *d++ = (char)((isprint(t))? t : ' ');
void fix_google_param(char *s) {
    if(unlikely(!s)) return;

    for( ; *s ;s++) {
        if(!isalnum(*s) && *s != '.' && *s != '_' && *s != '-')
            *s = '_';
    }
}

    // validate the google parameters given
    fix_google_param(google_out);
    fix_google_param(google_sig);
    fix_google_param(google_reqId);
    fix_google_param(google_version);
    fix_google_param(responseHandler);
    fix_google_param(outFileName);
CVE-2018-18838 (C, published 2019-06-18T16:15Z)
Description: value: An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter to api/v1/registry.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/netdata/netdata
Files changed:
libnetdata/url/url.c
web/api/web_api_v1.c
Commit message: fixed vulnerabilities identified by red4sec.com (#4521)



Vulnerable code:
                *d++ = from_hex(s[1]) << 4 | from_hex(s[2]);

Fixed code:
                char t = from_hex(s[1]) << 4 | from_hex(s[2]);
                // avoid HTTP header injection
                *d++ = (char)((isprint(t))? t : ' ');
void fix_google_param(char *s) {
    if(unlikely(!s)) return;

    for( ; *s ;s++) {
        if(!isalnum(*s) && *s != '.' && *s != '_' && *s != '-')
            *s = '_';
    }
}

    // validate the google parameters given
    fix_google_param(google_out);
    fix_google_param(google_sig);
    fix_google_param(google_reqId);
    fix_google_param(google_version);
    fix_google_param(responseHandler);
    fix_google_param(outFileName);
CVE-2018-18839 (C, published 2019-06-18T16:15Z)
Description: value: An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via api/v1/alarms. NOTE: the vendor says "is intentional.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/netdata/netdata
Files changed:
libnetdata/url/url.c
web/api/web_api_v1.c
Commit message: fixed vulnerabilities identified by red4sec.com (#4521)



Vulnerable code:
                *d++ = from_hex(s[1]) << 4 | from_hex(s[2]);

Fixed code:
                char t = from_hex(s[1]) << 4 | from_hex(s[2]);
                // avoid HTTP header injection
                *d++ = (char)((isprint(t))? t : ' ');
void fix_google_param(char *s) {
    if(unlikely(!s)) return;

    for( ; *s ;s++) {
        if(!isalnum(*s) && *s != '.' && *s != '_' && *s != '-')
            *s = '_';
    }
}

    // validate the google parameters given
    fix_google_param(google_out);
    fix_google_param(google_sig);
    fix_google_param(google_reqId);
    fix_google_param(google_version);
    fix_google_param(responseHandler);
    fix_google_param(outFileName);
CVE-2021-41166 (Unknown, published 2022-01-26T23:15Z)
Description: value: The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/nextcloud/android
Files changed:
Commit message: Merge pull request from GHSA-wff9-w6wc-h67g

Fix GHSL-2021-1008 by using permission instead of readPermission

Vulnerable code:

Fixed code:
CVE-2021-41166 (XML, published 2022-01-26T23:15Z)
Description: value: The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/nextcloud/android
Files changed:
src/main/AndroidManifest.xml
Commit message: Fix GHSL-2021-1008 by using permission instead of readPermission

Signed-off-by: tobiasKaminsky <tobias@kaminsky.me>


Vulnerable code:
            android:exported="true"
            android:readPermission="android.permission.MANAGE_DOCUMENTS" />

Fixed code:
            android:permission="android.permission.MANAGE_DOCUMENTS"
            android:exported="true">
        </provider>
CVE-2017-20152 (PHP, published 2022-12-30T12:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in aerouk imageserve. Affected is an unknown function of the file public/viewer.php of the component File Handler. The manipulation of the argument filelocation leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is bd23c784f0e5cb12f66d15c100248449f87d72e2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217056.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/aerouk/imageserve
Files changed:
public/viewer.php
Commit message: Fix path traversal exploit

Using path travel and viewer.php you can get files like the config file.
[url]/viewer.php?type=png&file=../png/../png/../png/jAfQv

Vulnerable code:
if ( ! file_exists($filelocation)) {

Fixed code:
if ( ! file_exists(realpath($filelocation)) || ! array_key_exists($type, $types) ) {
CVE-2017-20153 (Other, published 2022-12-30T12:15Z)
Description: value: A vulnerability has been found in aerouk imageserve and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument REQUEST_URI leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2ac3cd4f90b4df66874fab171376ca26868604c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217057 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/aerouk/imageserve
Files changed:
public/protected/templates/viewer.phtml
Commit message: Fixed XSS

REQUEST_URI is not parsed by PHP - only by new browsers.
Can be used for XSS with curl or for example file get contents.
[url]?x="><h1>Hi</h1>

Vulnerable code:
        <meta name="twitter:url" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']; ?>" />

Fixed code:
        <meta name="twitter:url" content="<?php echo $protocol; ?>://<?php echo $_SERVER['SERVER_NAME'] . htmlspecialchars($_SERVER['REQUEST_URI']); ?>" />