hitoshura25/cvefixes huggingface dataset:
CVE-2022-3341 (C, published 2023-01-12T15:15Z)
Description: value: A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/nutdec.c
Commit message: avformat/nutdec: Add check for avformat_new_stream

Check for failure of avformat_new_stream() and propagate
the error code.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
    for (i = 0; i < stream_count; i++)
        avformat_new_stream(s, NULL);
    int initialized_stream_count;
    } while (decode_main_header(nut) < 0);

Fixed code:
    for (i = 0; i < stream_count; i++) {
        if (!avformat_new_stream(s, NULL)) {
            ret = AVERROR(ENOMEM);
            goto fail;
        }
    }
    int initialized_stream_count, ret;
    ret = 0;
        if (ret == AVERROR(ENOMEM))
            return ret;

    } while ((ret = decode_main_header(nut)) < 0);
CVE-2023-46407 (C, published 2023-10-27T20:15Z)
Description: value: FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/jpegxl_parser.c
Commit message: avcodec/jpegxl_parser: fix OOB read regression

In f7ac3512f5b5cb8eb149f37300b43461d8e93af3 the size of the dynamically
allocated buffer was shrunk, but it was made too small for very small
alphabet sizes. This patch restores the size to prevent an OOB read.

Reported-by: Cole Dilorenzo <coolkingcole@gmail.com>
Signed-off-by: Leo Izen <leo.izen@gmail.com>


Vulnerable code:
    VLC level1_vlc;
    if (total_code != 32 && num_codes >= 2 || num_codes < 1)
        return AVERROR_INVALIDDATA;
    buf = av_mallocz(dist->alphabet_size * (2 * sizeof(int8_t) + sizeof(int16_t) + sizeof(uint32_t))
    level2_lens_s = (int8_t *)(buf + dist->alphabet_size * sizeof(int8_t));
    level2_syms = (int16_t *)(buf + dist->alphabet_size * (2 * sizeof(int8_t)));
    level2_codecounts = (uint32_t *)(buf + dist->alphabet_size * (2 * sizeof(int8_t) + sizeof(int16_t)));
                extra = 4 * (repeat_count_prev - 2) - repeat_count_prev + extra;
            if (i + extra > dist->alphabet_size) {
                ret = AVERROR_INVALIDDATA;
                goto end;
            }
                extra = 8 * (repeat_count_zero - 2) - repeat_count_zero + extra;

Fixed code:
    VLC level1_vlc = { 0 };
    if (total_code != 32 && num_codes >= 2 || num_codes < 1) {
        ret = AVERROR_INVALIDDATA;
        goto end;
    }
    buf = av_mallocz(MAX_PREFIX_ALPHABET_SIZE * (2 * sizeof(int8_t) + sizeof(int16_t) + sizeof(uint32_t))
    level2_lens_s = (int8_t *)(buf + MAX_PREFIX_ALPHABET_SIZE * sizeof(int8_t));
    level2_syms = (int16_t *)(buf + MAX_PREFIX_ALPHABET_SIZE * (2 * sizeof(int8_t)));
    level2_codecounts = (uint32_t *)(buf + MAX_PREFIX_ALPHABET_SIZE * (2 * sizeof(int8_t) + sizeof(int16_t)));
        if (get_bits_left(gb) < 0) {
            ret = AVERROR_BUFFER_TOO_SMALL;
            goto end;
        }
                extra += 4 * (repeat_count_prev - 2) - repeat_count_prev;
            extra = FFMIN(extra, dist->alphabet_size - i);
                extra += 8 * (repeat_count_zero - 2) - repeat_count_zero;
            extra = FFMIN(extra, dist->alphabet_size - i);
CVE-2023-47470 (C, published 2023-11-16T03:15Z)
Description: value: Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a denial of service (DoS) via the ref_pic_list_struct function in libavcodec/evc_ps.c
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/evc_ps.c
Commit message: avcodec/evc_ps: Check ref_pic_num and sps_max_dec_pic_buffering_minus1

Fixes: out of array write

Found-by: dongsookim@korea.ac.kr
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
static int ref_pic_list_struct(GetBitContext *gb, RefPicListStruct *rpl)
        for (int i = 0; i < sps->num_ref_pic_list_in_sps[0]; ++i)
            ref_pic_list_struct(gb, &sps->rpls[0][i]);
            for (int i = 0; i < sps->num_ref_pic_list_in_sps[1]; ++i)
                ref_pic_list_struct(gb, &sps->rpls[1][i]);

Fixed code:
static int ref_pic_list_struct(EVCParserSPS *sps, GetBitContext *gb, RefPicListStruct *rpl)

    if ((unsigned)rpl->ref_pic_num  > sps->sps_max_dec_pic_buffering_minus1)
        return AVERROR_INVALIDDATA;

        if ((unsigned)sps->sps_max_dec_pic_buffering_minus1 > 16 - 1)
            return AVERROR_INVALIDDATA;
        for (int i = 0; i < sps->num_ref_pic_list_in_sps[0]; ++i) {
            ret = ref_pic_list_struct(sps, gb, &sps->rpls[0][i]);
            if (ret < 0)
                goto fail;
        }
            for (int i = 0; i < sps->num_ref_pic_list_in_sps[1]; ++i) {
                ret = ref_pic_list_struct(sps, gb, &sps->rpls[1][i]);
                if (ret < 0)
                    goto fail;
            }
CVE-2023-50007 (C, published 2024-04-19T17:15Z)
Description: value: Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via theav_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavfilter/af_afwtdn.c
Commit message: avfilter/af_afwtdn: fix crash with EOF handling


Vulnerable code:
            out->nb_samples += s->padd_samples;
    ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
    if (ret < 0)
        return ret;
    if (ret > 0)
        return filter_frame(inlink, in);
        if (status == AVERROR_EOF) {
            while (s->padd_samples != 0) {
                ret = filter_frame(inlink, NULL);
                if (ret < 0)
                    return ret;
            }
            ff_outlink_set_status(outlink, status, pts);
            return ret;
        }

Fixed code:
    int eof;
            out->nb_samples = FFMAX(0, out->nb_samples + s->padd_samples);
    if (!s->eof) {
        ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
        if (ret < 0)
            return ret;
        if (ret > 0)
            return filter_frame(inlink, in);
    }
        if (status == AVERROR_EOF)
            s->eof = 1;

    if (s->eof && s->padd_samples != 0) {
        return filter_frame(inlink, NULL);
    } else if (s->eof) {
        ff_outlink_set_status(outlink, AVERROR_EOF, s->eof_pts);
        return 0;
    }
CVE-2023-50008 (C, published 2024-04-19T17:15Z)
Description: value: Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the av_malloc function in libavutil/mem.c:105:9 component.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavfilter/vf_colorcorrect.c
Commit message: avfilter/vf_colorcorrect: fix memory leaks


Vulnerable code:

Fixed code:
    av_freep(&s->uhistogram);
    av_freep(&s->vhistogram);
CVE-2024-22860 (C, published 2024-01-27T06:15Z)
Description: value: Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavformat/jpegxl_anim_dec.c
Commit message: avformat/jpegxl_anim_dec: Check that size fits within argument

Fixes: out of array access
Fixes: 61991/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5524679648215040
Fixes: 62181/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5504964305485824
Fixes: 62214/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-4782972823535616

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:

Fixed code:
    if (size > INT_MAX)
        return AVERROR(EDOM);
CVE-2024-22861 (C, published 2024-01-27T07:15Z)
Description: value: Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/osq.c
Commit message: avcodec/osq: fix type of nb_samples

Fixes crash caused by signed integer overflow.


Vulnerable code:
    int64_t nb_samples;

Fixed code:
    uint64_t nb_samples;
CVE-2024-22862 (C, published 2024-01-27T06:15Z)
Description: value: Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/FFmpeg/FFmpeg
Files changed:
libavcodec/jpegxl_parser.c
Commit message: avcodec/jpegxl_parser: Check for ctx->skip overflow

Fixes: out of array access
Fixes: 62113/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5025082076168192

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


Vulnerable code:
        if (size <= head_size + 4)

Fixed code:
        if (size <= head_size + 4 || size > INT_MAX - ctx->skip)
CVE-2021-3820 (JavaScript, published 2021-09-27T13:15Z)
Description: value: inflect is vulnerable to Inefficient Regular Expression Complexity
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/pksunkara/inflect
Files changed:
lib/methods.js
Commit message: Fix CVE-2021-3820


Vulnerable code:
  self = util.string.gsub(self, /([A-Z]+)([A-Z][a-z])/, '$1_$2');
  return inflect.camelize(inflect.singularize(util.string.gsub(table_name, /.*\./, '')));

Fixed code:
  self = util.string.gsub(self, /([A-Z])([A-Z][a-z])/, '$1_$2');
  return inflect.camelize(inflect.singularize(util.string.gsub(table_name, /^.*\./, '')));
CVE-2018-18546 (PHP, published 2018-10-21T01:29Z)
Description: value: ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/top-think/thinkphp
Files changed:
ThinkPHP/Library/Think/Db/Driver.class.php
Commit message: 改进


Vulnerable code:
                    if (false === strpos($val, '(') && false === strpos($val, ';')) {
                        $array[] = $this->parseKey($val);
                    }
                } elseif (false === strpos($key, ')') && false === strpos($key, '#')) {
                    $sort    = in_array(strtolower($val), array('asc', 'desc')) ? ' ' . $val : '';
        } else {
            foreach (explode(',', $order) as $val) {
                if (preg_match('/\s+(ASC|DESC)$/i', rtrim($val), $match, PREG_OFFSET_CAPTURE)) {
                    $array[] = $this->parseKey(ltrim(substr($val, 0, $match[0][1]))) . ' ' . $match[1][0];
                } elseif (false === strpos($val, '(') && false === strpos($val, ';')) {
                    $array[] = $this->parseKey($val);
                }
            }

Fixed code:
        if (is_string($order) && '[RAND]' != $order) {
            $order = explode(',', $order);
        }

                    list($key, $sort) = explode(' ', strpos($val, ' ') ? $val : $val . ' ');
                } else {
                    $sort = $val;
                }

                if (preg_match('/^[\w]+$/', $key)) {
                    $sort    = strtoupper($sort);
                    $sort    = in_array($sort, ['ASC', 'DESC'], true) ? ' ' . $sort : '';
CVE-2018-20164 (Unknown, published 2019-02-13T14:29Z)
Description: value: An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-185 \u2014 Incorrect Regular Expression
The product specifies a regular expression in a way that causes data to be improperly matched or compared.
Repository: https://github.com/ua-parser/uap-core
Files changed:
Commit message: Merge pull request #363 from commenthol/safe-regex

regexes update

Vulnerable code:

Fixed code:
CVE-2018-20164 (JSON, published 2019-02-13T14:29Z)
Description: value: An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-185 \u2014 Incorrect Regular Expression
The product specifies a regular expression in a way that causes data to be improperly matched or compared.
Repository: https://github.com/ua-parser/uap-core
Files changed:
package.json
Commit message: 0.6.0


Vulnerable code:
  "version": "0.5.0",

Fixed code:
  "version": "0.6.0",
CVE-2020-5243 (Unknown, published 2020-02-21T00:15Z)
Description: value: uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/ua-parser/uap-core
Files changed:
Commit message: Merge pull request from GHSA-cmcx-xhr8-3w9p

Advisory fix 1

Vulnerable code:

Fixed code:
CVE-2021-21317 (Unknown, published 2021-02-16T18:15Z)
Description: value: uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/ua-parser/uap-core
Files changed:
Commit message: Merge pull request from GHSA-p4pj-mg4r-x6v4

fix: redos

Vulnerable code:

Fixed code:
CVE-2009-3287 (Ruby, published 2009-09-22T10:30Z)
Description: value: lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/macournoyer/thin
Files changed:
CHANGELOG
lib/thin/connection.rb
lib/thin/request.rb
lib/thin/version.rb
spec/connection_spec.rb
Commit message: Fix Remote address spoofing vulnerability in Connection#remote_address [Alexey Borzenkov]


Vulnerable code:
      @request.forwarded_for || socket_address
    FORWARDED_FOR     = 'HTTP_X_FORWARDED_FOR'.freeze
    def forwarded_for
      @env[FORWARDED_FOR]
    end

    TINY     = 2
    CODENAME = "I Find Your Lack of Sauce Disturbing".freeze
  it "should return HTTP_X_FORWARDED_FOR as remote_address" do
    @connection.remote_address.should == '1.2.3.4'

Fixed code:
 * Fix Remote address spoofing vulnerability in Connection#remote_address [Alexey Borzenkov]
      socket_address
    TINY     = 3
    CODENAME = "Astroboy".freeze
  it "should not return HTTP_X_FORWARDED_FOR as remote_address" do
    @connection.stub!(:socket_address).and_return("127.0.0.1")
    @connection.remote_address.should == "127.0.0.1"
CVE-2018-6333 (JavaScript, published 2018-12-31T23:29Z)
Description: value: The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/facebook/nuclide
Files changed:
pkg/nuclide-hhvm/lib/main.js
Commit message: Ignore invalid hostnames in hhvm-attach deep link

Summary: Provide nicer handling and an error message when following a deep link requesting HHVM debugger attach that has a malformed host name.

Reviewed By: hansonw

Differential Revision: D7308417

fbshipit-source-id: 60bae4013444008980dda9cda8dec5f8ae20944f


Vulnerable code:

Fixed code:

    // Allow only valid hostname characters, per RFC 952:
    // https://tools.ietf.org/html/rfc952
    const invalidMatch = host.match(/[^A-Za-z0-9\-._]+/);
    if (invalidMatch != null) {
      atom.notifications.addError(
        'The specified host name contained invalid characters.',
      );
      return;
    }
CVE-2024-40627 (Unknown, published 2024-07-15T20:15Z)
Description: value: Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware` allows all HTTP `OPTIONS` requests without evaluating it against any policy. If an application provides different responses to HTTP `OPTIONS` requests based on an entity existing (such as to indicate whether an entity is writable on a system level), an unauthenticated attacker could discover which entities exist within an application. This issue has been addressed in release version 2.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/busykoala/fastapi-opa
Files changed:
Commit message: Merge pull request #73 from busykoala/options_auth

Authenticate OPTIONS requests to prevent information leaks

Vulnerable code:

Fixed code:
CVE-2019-16892 (Unknown, published 2019-09-25T22:15Z)
Description: value: In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
Severity: HIGH (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rubyzip/rubyzip
Files changed:
Commit message: Merge pull request #403 from rubyzip/check-size

Validate entry sizes when extracting

Vulnerable code:

Fixed code:
CVE-2019-8293 (PHP, published 2019-12-23T22:15Z)
Description: value: Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/abcprintf/upload-image-with-ajax
Files changed:
upload.php
Commit message: update #Arbitrary file upload vulnerability


Vulnerable code:

Fixed code:
            exit();
            exit();
            exit();
            exit();