hitoshura25/cvefixes huggingface dataset:
CVE-2017-13047 (Other, published 2017-09-14T06:29Z)
Description: value: The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-isoclns.c
tests/TESTLIST
tests/esis_opt_prot-oobr.out
tests/esis_snpa_asan-3.out
tests/esis_snpa_asan-4.out
tests/esis_snpa_asan-5.out
Commit message: CVE-2017-13047/ES-IS: put an existing bounds check right

The bounds check in esis_print() tested one pointer at the beginning of
a loop that incremented another, make the trivial fix. While at it, make
the function print a standard marker when it detects truncated data and
update some existing ES-IS tests respectively.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
                    ND_TCHECK(*pptr);
	return;
	  SNPA (length: 0): <empty>
	  Unknown Option #0, length 0, value: 
	  NET (length: 4) 00.0000.00
	  NET (length: 0): isonsap_string: illegal length

Fixed code:
                    ND_TCHECK(*tptr);
        ND_PRINT((ndo, "[|esis]"));
esis_opt_prot-oobr	esis_opt_prot-oobr.pcap		esis_opt_prot-oobr.out	-v -c1
ES-IS, length 33559803
	redirect (6), v: 1, checksum: 0x00c6 (unverified), holding time: 2303s, length indicator: 54
	  00.8e
	  SNPA (length: 0): <empty>
	  Protocols supported Option #129, length 11, value: CLNP (0x81), [|esis]
	  SNPA (length: 0): <empty>[|esis]
	  Unknown Option #0, length 0, value: [|esis]
	  NET (length: 4) 00.0000.00[|esis]
	  NET (length: 0): isonsap_string: illegal length[|esis]
CVE-2017-13048 (Other, published 2017-09-14T06:29Z)
Description: value: The RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvp_obj_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-rsvp.c
tests/TESTLIST
tests/rsvp_fast_reroute-oobr.out
Commit message: CVE-2017-13048/RSVP: fix decoding of Fast Reroute objects

In rsvp_obj_print() the case block for Class-Num 205 (FAST_REROUTE) from
RFC 4090 Section 4.1 could over-read accessing the buffer contents before
making the bounds check. Rearrange those steps the correct way around.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
            bw.i = EXTRACT_32BITS(obj_ptr.rsvp_obj_frr->bandwidth);

Fixed code:
                bw.i = EXTRACT_32BITS(obj_ptr.rsvp_obj_frr->bandwidth);
                bw.i = EXTRACT_32BITS(obj_ptr.rsvp_obj_frr->bandwidth);
rsvp_fast_reroute-oobr	rsvp_fast_reroute-oobr.pcap	rsvp_fast_reroute-oobr.out -v -c1
IP (tos 0x0, ttl 224, id 17920, offset 0, flags [none], proto RSVP (46), length 42024, bad cksum 3700 (->fc41)!)
    0.203.243.128 > 0.26.0.0: 
	RSVPv1 Path Message (1), Flags: [Refresh reduction capable], length: 41218, ttl: 227, checksum: 0x00f4
	  Fast Re-Route Object (205) Flags: [ignore and forward if unknown], Class-Type: Unknown (0), length: 4
	  Fast Re-Route Object (205) Flags: [ignore and forward if unknown], Class-Type: Unknown (0), length: 4
		 [|rsvp]
CVE-2017-13049 (Other, published 2017-09-14T06:29Z)
Description: value: The Rx protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-rx.c:ubik_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-rx.c
tests/TESTLIST
tests/rx_ubik-oobr.out
Commit message: CVE-2017-13049/Rx: add a missing bounds check for Ubik

One of the case blocks in ubik_print() didn't check bounds before
fetching 32 bits of packet data and could overread past the captured
packet data by that amount.

This fixes a buffer over-read discovered by Henri Salo from Nixu
Corporation.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:

Fixed code:
			ND_TCHECK_32BITS(bp);
# bad packets from Henri Salo
rx_ubik-oobr		rx_ubik-oobr.pcap		rx_ubik-oobr.out -c1

IP truncated-ip - 2598 bytes missing! 222.241.104.198.3503 > 131.63.241.146.7002:  rx data pt ubik call disk-lock tid 50266112.32382 file 2122216448 pos 545160708 length 1087685554 [|ubik] (2632)
CVE-2017-13054 (Other, published 2017-09-14T06:29Z)
Description: value: The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_private_8023_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-lldp.c
tests/TESTLIST
tests/lldp_8023_mtu-oobr.out
Commit message: CVE-2017-13054/LLDP: add a missing length check

In lldp_private_8023_print() the case block for subtype 4 (Maximum Frame
Size TLV, IEEE 802.3bc-2009 Section 79.3.4) did not include the length
check and could over-read the input buffer, put it right.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:

Fixed code:
        if (tlv_len < 6) {
            return hexdump;
        }
lldp_8023_mtu-oobr	lldp_8023_mtu-oobr.pcap	lldp_8023_mtu-oobr.out	-v -c1
LLDP, length 4293194266
	Organization specific TLV (127), length 4: OUI IEEE 802.3 Private (0x00120f)
	  Max frame size Subtype (4)
	[|LLDP]
CVE-2017-13687 (C, published 2017-09-14T06:29Z)
Description: value: The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-chdlc.c
Commit message: CVE-2017-13687/CHDLC: Improve bounds and length checks.

Prevent a possible buffer overread in chdlc_print() and replace the
custom check in chdlc_if_print() with a standard check in chdlc_print()
so that the latter certainly does not over-read even when reached via
juniper_chdlc_print(). Add length checks.


Vulnerable code:
	register u_int length = h->len;
	register u_int caplen = h->caplen;

	if (caplen < CHDLC_HDRLEN) {
		ND_PRINT((ndo, "[|chdlc]"));
		return (caplen);
	}
        return (chdlc_print(ndo, p,length));

Fixed code:
	return chdlc_print(ndo, p, h->len);
	const u_char *bp = p;
	if (length < CHDLC_HDRLEN)
		goto trunc;
	ND_TCHECK2(*p, CHDLC_HDRLEN);
                if (length < 2)
                    goto trunc;
                ND_TCHECK_16BITS(p);

trunc:
	ND_PRINT((ndo, "[|chdlc]"));
	return ndo->ndo_snapend - bp;
CVE-2017-13687 (Other, published 2017-09-14T06:29Z)
Description: value: The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/hoobr_chdlc_print.out
Commit message: CVE-2017-13687/CHDLC: Add a test.

This is for the fix made a few commits before, which had no tests.

Add a test using the capture file supplied by Kamil Frankowicz.


Vulnerable code:

Fixed code:
hoobr_chdlc_print	hoobr_chdlc_print.pcap		hoobr_chdlc_print.out
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
[|chdlc]
CVE-2017-13689 (Other, published 2017-09-14T06:29Z)
Description: value: The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-isakmp.c
tests/TESTLIST
tests/ikev1_id_ipv6_addr_subnet-oobr.out
Commit message: CVE-2017-13689/IKEv1: Fix addr+subnet length check.

An IPv6 address plus subnet mask is 32 bytes, not 20 bytes.
16 bytes of IPv6 address, 16 bytes of subnet mask.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:
			if (len < 20)
				ND_PRINT((ndo," len=%d [bad: < 20]", len));

Fixed code:
			if (len < 32)
				ND_PRINT((ndo," len=%d [bad: < 32]", len));
ikev1_id_ipv6_addr_subnet-oobr	ikev1_id_ipv6_addr_subnet-oobr.pcap	ikev1_id_ipv6_addr_subnet-oobr.out	-v
IP (tos 0x0, ttl 100, id 40207, offset 0, flags [+, DF, rsvd], proto UDP (17), length 32808, bad cksum 8e7f (->bc78)!)
    16.0.128.20.500 > 12.251.0.45.0: isakmp 1.0 msgid 0d101010: phase 2/others ? #16[]:
    (id: idtype=IPv6net protoid=16 port=4112 len=24 [bad: < 32]) [|#145] (len mismatch: isakmp 4278190080/ip 4856)
CVE-2017-13690 (Other, published 2017-09-14T06:29Z)
Description: value: The IKEv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-isakmp.c
tests/TESTLIST
tests/isakmp-various-oobr.out
Commit message: CVE-2017-13690/IKEv2: Fix some bounds checks.

Use a pointer of the correct type in ND_TCHECK(), or use ND_TCHECK2()
and provide the correct length.

While we're at it, remove the blank line between some checks and the
UNALIGNED_MEMCPY()s they protect.

Also, note the places where we print the entire payload.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).


Vulnerable code:


	ND_TCHECK(*ext);
	ND_TCHECK(*ext);
	ND_TCHECK(*ext);



Fixed code:
		/* Print the entire payload in hex */
		/* Print the entire payload in hex */
		/* Print the entire payload in hex */
		/* Print the entire payload in hex */
		/* Print the entire payload in hex */
		/* Print the entire payload in hex */
		/* Print the entire payload in hex */
	ND_TCHECK(*k);
	const struct ikev2_id *idp;
	idp = (const struct ikev2_id *)ext;
	ND_TCHECK(*idp);
		/* Print the entire payload in hex */
	ND_TCHECK2(*ext, sizeof(a));
		/* Print the entire payload in hex */
isakmp-various-oobr	isakmp-various-oobr.pcap	isakmp-various-oobr.out	-v
IP (tos 0xfb,CE, ttl 17, id 21263, offset 0, flags [+, DF, rsvd], proto UDP (17), length 296, bad cksum 1ff (->f67d)!)
    16.0.128.20.500 > 12.251.225.45.49152: isakmp 1.0 msgid 10101010: phase 2/others ? #16[]:
    ( [|v2ke]) (len mismatch: isakmp 2130706432/ip 268)
IP (tos 0x12,ECT(0), ttl 17, id 21263, offset 4096, flags [DF, rsvd], proto UDP (17), length 296, bad cksum 1ff (->939f)!)
    0.0.0.5 > 0.0.0.0: ip-proto-17
CVE-2017-13725 (Other, published 2017-09-14T06:29Z)
Description: value: The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
tests/TESTLIST
tests/hoobr_rt6_print.out
Commit message: CVE-2017-13725/IPv6 R.H.: Add a capture file.

This is from Kamil Frankowicz testing an existing fix.

This is a test for the print-rt6.c fix I made after inspecting the code.


Vulnerable code:

Fixed code:
hoobr_rt6_print		hoobr_rt6_print.pcap		hoobr_rt6_print.out
unknown ip 3
unknown ip 3
IP6 3030:3030:3030:3030:3030:3030:3030:3030 > 3030:3030:3030:3030:3030:3030:3030:3030: [|srcrt]
CVE-2017-13725 (C, published 2017-09-14T06:29Z)
Description: value: The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-rt6.c
Commit message: CVE-2017-13725/IPv6 R.H.: Check for the existence of all fields before fetching them.

Don't fetch the length field from the header until after we've checked
for the existence of a field at or after that field.

(Found by code inspection, not by a capture.)


Vulnerable code:
	len = dp->ip6r_len;

Fixed code:
	len = dp->ip6r_len;
CVE-2018-16301 (Other, published 2019-10-03T16:15Z)
Description: value: The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
CHANGES
Commit message: Add CVE-2018-16301 to CHANGES. [skip ci]

One of the effects of commit faf8fb7 was fixing a buffer overflow that
was discovered and reported by Include Security (case reference "F2").
Their work was sponsored by Mozilla under the Secure Open Source
program.  The vulnerability was assigned CVE-2018-16301 on 2018-09-01
(MITRE request reference "scr562827"), but was not properly documented
afterwards.  Add a line to the change log section for 4.99.0, which at
the time of this writing is the first release to incorporate the fix.

See also https://github.com/the-tcpdump-group/libpcap/issues/855


Vulnerable code:

Fixed code:
    CVE-2018-16301: For the -F option handle large input files safely.
CVE-2020-8036 (C, published 2020-11-04T18:15Z)
Description: value: The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-someip.c
Commit message: SOME/IP: Fix terminating a "struct tok" array

Moreover:
Declare static and const the "struct tok" arrays.


Vulnerable code:
struct tok message_type_values[] = {
struct tok return_code_values[] = {

Fixed code:
static const struct tok message_type_values[] = {
static const struct tok return_code_values[] = {
    { 0, NULL }
CVE-2024-2397 (C, published 2024-04-12T14:15Z)
Description: value: Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLT_PPP_SERIAL .pcap savefile.  This problem does not affect any tcpdump release, but it affected the git master branch from 2023-06-05 to 2024-03-21.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-ppp.c
print.c
Commit message: ppp: use the buffer stack for the de-escaping buffer.

This both saves the buffer for freeing later and saves the packet
pointer and snapend to be restored when packet processing is complete,
even if an exception is thrown with longjmp.

This means that the hex/ASCII printing in pretty_print_packet()
processes the packet data as captured or read from the savefile, rather
than as modified by the PPP printer, so that the bounds checking is
correct.

That fixes CVE-2024-2397, which was caused by an exception being thrown
by the hex/ASCII printer (which should only happen if those routines are
called by a packet printer, not if they're called for the -X/-x/-A
flag), which jumps back to the setjmp() that surrounds the packet
printer.  Hilarity^Winfinite looping ensues.

Also, restore ndo->ndo_packetp before calling the hex/ASCII printing
routine, in case nd_pop_all_packet_info() didn't restore it.


Vulnerable code:
	const void *sb, *se;
	b = (u_char *)nd_malloc(ndo, caplen);
	if (b == NULL)
		return;
	 * Change the end pointer, so bounds checks work.
	 * Change the pointer to packet data to help debugging.
	sb = ndo->ndo_packetp;
	se = ndo->ndo_snapend;
	ndo->ndo_packetp = b;
	ndo->ndo_snapend = t;
	ndo->ndo_packetp = sb;
	ndo->ndo_snapend = se;
	ndo->ndo_packetp = sb;
	ndo->ndo_snapend = se;
	 * Restore the original snapend, as a printer might have
	 * changed it.

Fixed code:
#include <stdlib.h>

	b = (u_char *)malloc(caplen);
	if (b == NULL) {
		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
			"%s: malloc", __func__);
	}
	 * Switch to the output buffer for dissection, and save it
	 * on the buffer stack so it can be freed; our caller must
	 * pop it when done.
	if (!nd_push_buffer(ndo, b, b, (u_int)(t - b))) {
		free(b);
		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
			"%s: can't push buffer on buffer stack", __func__);
	}
	nd_pop_packet_info(ndo);
	nd_pop_packet_info(ndo);
	 * Restore the originals snapend and packetp, as a printer
	 * might have changed them.
	 *
	 * XXX - nd_pop_all_packet_info() should have restored the
	 * original values, but, just in case....
	ndo->ndo_packetp = sp;
CVE-2022-0272 (Kotlin, published 2022-04-21T17:15Z)
Description: value: Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/detekt/detekt
Files changed:
detekt-core/src/main/kotlin/io/gitlab/arturbosch/detekt/core/baseline/BaselineFormat.kt
Commit message: Parse Baseline in a secure way (#4499)



Vulnerable code:
                val reader = SAXParserFactory.newInstance().newSAXParser()

Fixed code:
import javax.xml.XMLConstants
                val reader = SAXParserFactory.newInstance()
                    .apply {
                        setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)
                    }
                    .newSAXParser()
CVE-2015-10078 (PHP, published 2023-02-12T14:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress. This issue affects the function send_welcome_email_url of the file resend-welcome-email.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is b14c1f66d307783f0ae74f88088a85999107695c. It is recommended to upgrade the affected component. The identifier VDB-220637 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/atwellpub/resend-welcome-email
Files changed:
resend-welcome-email.php
Commit message: Escaping result of wp_nonce_url, since it does not use proper esc_url function internally. See this post for details: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html


Vulnerable code:
			return wp_nonce_url( add_query_arg( array(
			), '') , "send_welcome_email_{$user->ID}" );

Fixed code:
			return esc_url(wp_nonce_url( add_query_arg( array(
			), '') , "send_welcome_email_{$user->ID}" ));
CVE-2023-49793 (Unknown, published 2024-06-24T18:15Z)
Description: value: CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`.
The attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Ericsson/codechecker
Files changed:
Commit message: Merge pull request from GHSA-h26w-r4m5-8rrf

[cmd] Better sanitization for stored file names

Vulnerable code:

Fixed code:
CVE-2020-11011 (Unknown, published 2020-04-22T17:15Z)
Description: value: In Phproject before version 1.7.8, there's a vulnerability which allows users with access to file uploads to execute arbitrary code. This is patched in version 1.7.8.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/Alanaktion/phproject
Files changed:
Commit message: Merge pull request from GHSA-4j97-6w6q-gxjx

Add file type blacklist and prevent execution of uploaded files

Vulnerable code:

Fixed code: