Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
BmpDecoder.prototype.bit15=function(){var h=2*this.width%4;0!=h&&(h=4-h);for(var y=this.height-1;0<=y;y--){for(var A=0;A<this.width;A++){var B=this.buffer[this.pos+1]<<8|this.buffer[this.pos];this.pos+=2;var m=(B&31)/31*255|0,g=(B>>5&31)/31*255|0,b=B>>15?255:0,a=y*this.width*4+4*A;this.data[a]=(B>>10&31)/31*255|0;this.data[a+1]=g;this.data[a+2]=m;this.data[a+3]=b}this.pos+=h}};