rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.
Vulnerability ID: CVE-2017-7695
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/bigtreecms/BigTree-CMS
Published: 2017-04-11
File: core/inc/bigtree/apis/storage.php
Commit message: Fixing empty space at the end of a file name allowing dangerous files to be uploaded.
Thank you to math1as from l-team for the disclosure and fix.

https://github.com/bigtreecms/BigTree-CMS/issues/276
Commit author: Tim Buckingham

Vulnerable version (before fix):
 class BigTreeStorage {  		var $AutoJPEG = false; 		var $DisabledFileError = false; 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)$/i'; 		var $Service = ""; 		var $Cloud = false; 		var $Settings;

Fixed version (after fix):
 class BigTreeStorage {  		var $AutoJPEG = false; 		var $DisabledFileError = false; 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i'; 		var $Service = ""; 		var $Cloud = false; 		var $Settings;

Patch:
patch: @@ -8,7 +8,7 @@ class BigTreeStorage {
 
 		var $AutoJPEG = false;
 		var $DisabledFileError = false;
-		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)$/i';
+		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i';
 		var $Service = "";
 		var $Cloud = false;
 		var $Settings;
path: core/inc/bigtree/apis/storage.php
Vulnerability: FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.
Vulnerability ID: CVE-2017-7862
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-04-14
File: libavcodec/pictordec.c
Commit message: avcodec/pictordec: Fix logic error

Fixes: 559/clusterfuzz-testcase-6424225917173760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int decode_frame(AVCodecContext *avctx,      if (av_image_check_size(s->width, s->height, 0, avctx) < 0)         return -1;     if (s->width != avctx->width && s->height != avctx->height) {         ret = ff_set_dimensions(avctx, s->width, s->height);         if (ret < 0)             return ret;

Fixed version (after fix):
 static int decode_frame(AVCodecContext *avctx,      if (av_image_check_size(s->width, s->height, 0, avctx) < 0)         return -1;     if (s->width != avctx->width || s->height != avctx->height) {         ret = ff_set_dimensions(avctx, s->width, s->height);         if (ret < 0)             return ret;

Patch:
patch: @@ -142,7 +142,7 @@ static int decode_frame(AVCodecContext *avctx,
 
     if (av_image_check_size(s->width, s->height, 0, avctx) < 0)
         return -1;
-    if (s->width != avctx->width && s->height != avctx->height) {
+    if (s->width != avctx->width || s->height != avctx->height) {
         ret = ff_set_dimensions(avctx, s->width, s->height);
         if (ret < 0)
             return ret;
path: libavcodec/pictordec.c
Vulnerability: FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c.
Vulnerability ID: CVE-2017-7865
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-04-14
File: libavcodec/utils.c
Commit message: avcodec/utils: correct align value for interplay

Fixes out of array access
Fixes: 452/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,             w_align = 4;             h_align = 4;         }         break;     case AV_PIX_FMT_PAL8:     case AV_PIX_FMT_BGR8: void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,             w_align = 4;             h_align = 4;         }         if (s->codec_id == AV_CODEC_ID_JV) {             w_align = 8;             h_align = 8;         }

Fixed version (after fix):
 void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,             w_align = 4;             h_align = 4;         }         if (s->codec_id == AV_CODEC_ID_INTERPLAY_VIDEO) {             w_align = 8;             h_align = 8;         }         break;     case AV_PIX_FMT_PAL8:     case AV_PIX_FMT_BGR8: void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,             w_align = 4;             h_align = 4;         }         if (s->codec_id == AV_CODEC_ID_JV ||             s->codec_id == AV_CODEC_ID_INTERPLAY_VIDEO) {             w_align = 8;             h_align = 8;         }

Patch:
patch: @@ -376,6 +376,10 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
             w_align = 4;
             h_align = 4;
         }
+        if (s->codec_id == AV_CODEC_ID_INTERPLAY_VIDEO) {
+            w_align = 8;
+            h_align = 8;
+        }
         break;
     case AV_PIX_FMT_PAL8:
     case AV_PIX_FMT_BGR8:
@@ -385,7 +389,8 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
             w_align = 4;
             h_align = 4;
         }
-        if (s->codec_id == AV_CODEC_ID_JV) {
+        if (s->codec_id == AV_CODEC_ID_JV ||
+            s->codec_id == AV_CODEC_ID_INTERPLAY_VIDEO) {
             w_align = 8;
             h_align = 8;
         }
path: libavcodec/utils.c
Vulnerability: FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.
Vulnerability ID: CVE-2017-7866
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-04-14
File: libavcodec/pngdec.c
Commit message: avcodec/pngdec: Fix off by 1 size in decode_zbuf()

Fixes out of array access
Fixes: 444/fuzz-2-ffmpeg_VIDEO_AV_CODEC_ID_PNG_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int decode_zbuf(AVBPrint *bp, const uint8_t *data,     av_bprint_init(bp, 0, -1);      while (zstream.avail_in > 0) {         av_bprint_get_buffer(bp, 1, &buf, &buf_size);         if (!buf_size) {             ret = AVERROR(ENOMEM);             goto fail;         }         zstream.next_out  = buf;         zstream.avail_out = buf_size;         ret = inflate(&zstream, Z_PARTIAL_FLUSH);         if (ret != Z_OK && ret != Z_STREAM_END) {             ret = AVERROR_EXTERNAL;

Fixed version (after fix):
 static int decode_zbuf(AVBPrint *bp, const uint8_t *data,     av_bprint_init(bp, 0, -1);      while (zstream.avail_in > 0) {         av_bprint_get_buffer(bp, 2, &buf, &buf_size);         if (buf_size < 2) {             ret = AVERROR(ENOMEM);             goto fail;         }         zstream.next_out  = buf;         zstream.avail_out = buf_size - 1;         ret = inflate(&zstream, Z_PARTIAL_FLUSH);         if (ret != Z_OK && ret != Z_STREAM_END) {             ret = AVERROR_EXTERNAL;

Patch:
patch: @@ -437,13 +437,13 @@ static int decode_zbuf(AVBPrint *bp, const uint8_t *data,
     av_bprint_init(bp, 0, -1);
 
     while (zstream.avail_in > 0) {
-        av_bprint_get_buffer(bp, 1, &buf, &buf_size);
-        if (!buf_size) {
+        av_bprint_get_buffer(bp, 2, &buf, &buf_size);
+        if (buf_size < 2) {
             ret = AVERROR(ENOMEM);
             goto fail;
         }
         zstream.next_out  = buf;
-        zstream.avail_out = buf_size;
+        zstream.avail_out = buf_size - 1;
         ret = inflate(&zstream, Z_PARTIAL_FLUSH);
         if (ret != Z_OK && ret != Z_STREAM_END) {
             ret = AVERROR_EXTERNAL;
path: libavcodec/pngdec.c
Vulnerability: In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.
Vulnerability ID: CVE-2017-7875
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/derf/feh
Published: 2017-04-14
File: src/wallpaper.c
Commit message: Fix double-free/OOB-write while receiving IPC data

If a malicious client pretends to be the E17 window manager, it is
possible to trigger an out of boundary heap write while receiving an
IPC message.

The length of the already received message is stored in an unsigned
short, which overflows after receiving 64 KB of data. It's comparably
small amount of data and therefore achievable for an attacker.

When len overflows, realloc() will either be called with a small value
and therefore chars will be appended out of bounds, or len + 1 will be
exactly 0, in which case realloc() behaves like free(). This could be
abused for a later double-free attack as it's even possible to overwrite
the free information -- but this depends on the malloc implementation.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Commit author: Tobias Stoeckmann

Vulnerable version (before fix):
 char *enl_ipc_get(const char *msg_data) {  	static char *message = NULL; 	static unsigned short len = 0; 	char buff[13], *ret_msg = NULL; 	register unsigned char i; 	unsigned char blen;

Fixed version (after fix):
 char *enl_ipc_get(const char *msg_data) {  	static char *message = NULL; 	static size_t len = 0; 	char buff[13], *ret_msg = NULL; 	register unsigned char i; 	unsigned char blen;

Patch:
patch: @@ -795,7 +795,7 @@ char *enl_ipc_get(const char *msg_data)
 {
 
 	static char *message = NULL;
-	static unsigned short len = 0;
+	static size_t len = 0;
 	char buff[13], *ret_msg = NULL;
 	register unsigned char i;
 	unsigned char blen;
path: src/wallpaper.c
Vulnerability: A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
Vulnerability ID: CVE-2017-7897
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2017-04-18
File: core/timeline_inc.php
Commit message: Fix XSS in timeline_inc.php

Use of $_SERVER['PHP_SELF'] and outputting it as-is allows an attacker
to inject arbitrary JavaScript as part of the URL.

Using SCRIPT_NAME and passing it through string_sanitize_url() instead
prevents the attack.

Fixes #22742
Fixes https://github.com/mantisbt/mantisbt/pull/1094
Commit author: Damien Regad

Vulnerable version (before fix):
 $t_block_css = $t_collapse_block ? 'collapsed' : ''; $t_block_icon = $t_collapse_block ? 'fa-chevron-down' : 'fa-chevron-up';  $t_url_page = $_SERVER["PHP_SELF"]; $t_url_params = $_GET; if( isset( $t_url_params['all'] ) ) { 	unset( $t_url_params['all'] );

Fixed version (after fix):
 $t_block_css = $t_collapse_block ? 'collapsed' : ''; $t_block_icon = $t_collapse_block ? 'fa-chevron-down' : 'fa-chevron-up';  $t_url_page = string_sanitize_url( basename( $_SERVER['SCRIPT_NAME'] ) ); $t_url_params = $_GET; if( isset( $t_url_params['all'] ) ) { 	unset( $t_url_params['all'] );

Patch:
patch: @@ -46,7 +46,7 @@
 $t_block_css = $t_collapse_block ? 'collapsed' : '';
 $t_block_icon = $t_collapse_block ? 'fa-chevron-down' : 'fa-chevron-up';
 
-$t_url_page = $_SERVER["PHP_SELF"];
+$t_url_page = string_sanitize_url( basename( $_SERVER['SCRIPT_NAME'] ) );
 $t_url_params = $_GET;
 if( isset( $t_url_params['all'] ) ) {
 	unset( $t_url_params['all'] );
path: core/timeline_inc.php
Vulnerability: The iwgif_read_image function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
Vulnerability ID: CVE-2017-7962
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/jsummers/imageworsener
Published: 2017-04-19
File: src/imagew-gif.c
Commit message: Fixed a GIF decoding bug (divide by zero)

Fixes issue #15
Commit author: Jason Summers

Vulnerable version (before fix):
 static int iwgif_read_image(struct iwgifrcontext *rctx)  	rctx->image_width = (int)iw_get_ui16le(&rctx->rbuf[4]); 	rctx->image_height = (int)iw_get_ui16le(&rctx->rbuf[6]);  	rctx->interlaced = (int)((rctx->rbuf[8]>>6)&0x01); 

Fixed version (after fix):
 static int iwgif_read_image(struct iwgifrcontext *rctx)  	rctx->image_width = (int)iw_get_ui16le(&rctx->rbuf[4]); 	rctx->image_height = (int)iw_get_ui16le(&rctx->rbuf[6]); 	if(rctx->image_width<1 || rctx->image_height<1) { 		iw_set_error(rctx->ctx, "Invalid image dimensions"); 		goto done; 	}  	rctx->interlaced = (int)((rctx->rbuf[8]>>6)&0x01); 

Patch:
patch: @@ -614,6 +614,10 @@ static int iwgif_read_image(struct iwgifrcontext *rctx)
 
 	rctx->image_width = (int)iw_get_ui16le(&rctx->rbuf[4]);
 	rctx->image_height = (int)iw_get_ui16le(&rctx->rbuf[6]);
+	if(rctx->image_width<1 || rctx->image_height<1) {
+		iw_set_error(rctx->ctx, "Invalid image dimensions");
+		goto done;
+	}
 
 	rctx->interlaced = (int)((rctx->rbuf[8]>>6)&0x01);
path: src/imagew-gif.c
Vulnerability: Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
Vulnerability ID: CVE-2017-7991
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/exponentcms/exponent-cms
Published: 2017-04-22
File: framework/modules/eaas/controllers/eaasController.php
Commit message: fix sql injection issue
Commit author: dleffler

Vulnerable version (before fix):
 public function api() {             $ar->send();  //FIXME this doesn't seem to work correctly in this scenario         } else {             $key = expUnserialize(base64_decode(urldecode($this->params['apikey'])));             $cfg = new expConfig($key);             $this->config = $cfg->config;             if(empty($cfg->id)) {

Fixed version (after fix):
 public function api() {             $ar->send();  //FIXME this doesn't seem to work correctly in this scenario         } else {             $key = expUnserialize(base64_decode(urldecode($this->params['apikey'])));             preg_match('/[^a-zA-Z_][^a-zA-Z0-9_]*/', $key, $matches);             $key = $matches[0];             $cfg = new expConfig($key);             $this->config = $cfg->config;             if(empty($cfg->id)) {

Patch:
patch: @@ -80,6 +80,8 @@ public function api() {
             $ar->send();  //FIXME this doesn't seem to work correctly in this scenario
         } else {
             $key = expUnserialize(base64_decode(urldecode($this->params['apikey'])));
+            preg_match('/[^a-zA-Z_][^a-zA-Z0-9_]*/', $key, $matches);
+            $key = $matches[0];
             $cfg = new expConfig($key);
             $this->config = $cfg->config;
             if(empty($cfg->id)) {
path: framework/modules/eaas/controllers/eaasController.php
Vulnerability: crypto/ccm.c in the Linux kernel 4.9.x and 4.10.x through 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Vulnerability ID: CVE-2017-8065
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-04-23
File: crypto/ccm.c
Commit message: crypto: ccm - move cbcmac input off the stack

Commit f15f05b0a5de ("crypto: ccm - switch to separate cbcmac driver")
refactored the CCM driver to allow separate implementations of the
underlying MAC to be provided by a platform. However, in doing so, it
moved some data from the linear region to the stack, which violates the
SG constraints when the stack is virtually mapped.

So move idata/odata back to the request ctx struct, of which we can
reasonably expect that it has been allocated using kmalloc() et al.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Fixes: f15f05b0a5de ("crypto: ccm - switch to separate cbcmac driver")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Tested-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Commit author: Ard Biesheuvel

Vulnerable version (before fix):
 struct crypto_rfc4309_req_ctx {  struct crypto_ccm_req_priv_ctx { 	u8 odata[16]; 	u8 auth_tag[16]; 	u32 flags; 	struct scatterlist src[3]; static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain, 	AHASH_REQUEST_ON_STACK(ahreq, ctx->mac); 	unsigned int assoclen = req->assoclen; 	struct scatterlist sg[3]; 	u8 odata[16]; 	u8 idata[16]; 	int ilen, err;  	/* format control data for input */

Fixed version (after fix):
 struct crypto_rfc4309_req_ctx {  struct crypto_ccm_req_priv_ctx { 	u8 odata[16]; 	u8 idata[16]; 	u8 auth_tag[16]; 	u32 flags; 	struct scatterlist src[3]; static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain, 	AHASH_REQUEST_ON_STACK(ahreq, ctx->mac); 	unsigned int assoclen = req->assoclen; 	struct scatterlist sg[3]; 	u8 *odata = pctx->odata; 	u8 *idata = pctx->idata; 	int ilen, err;  	/* format control data for input */

Patch:
patch: @@ -45,6 +45,7 @@ struct crypto_rfc4309_req_ctx {
 
 struct crypto_ccm_req_priv_ctx {
 	u8 odata[16];
+	u8 idata[16];
 	u8 auth_tag[16];
 	u32 flags;
 	struct scatterlist src[3];
@@ -183,8 +184,8 @@ static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain,
 	AHASH_REQUEST_ON_STACK(ahreq, ctx->mac);
 	unsigned int assoclen = req->assoclen;
 	struct scatterlist sg[3];
-	u8 odata[16];
-	u8 idata[16];
+	u8 *odata = pctx->odata;
+	u8 *idata = pctx->idata;
 	int ilen, err;
 
 	/* format control data for input */
path: crypto/ccm.c
Vulnerability: drivers/char/virtio_console.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Vulnerability ID: CVE-2017-8067
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-04-23
File: drivers/char/virtio_console.c
Commit message: virtio-console: avoid DMA from stack

put_chars() stuffs the buffer it gets into an sg, but that buffer may be
on the stack. This breaks with CONFIG_VMAP_STACK=y (for me, it
manifested as printks getting turned into NUL bytes).

Signed-off-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Commit author: Omar Sandoval

Vulnerable version (before fix):
 static int put_chars(u32 vtermno, const char *buf, int count) { 	struct port *port; 	struct scatterlist sg[1];  	if (unlikely(early_put_chars)) 		return early_put_chars(vtermno, buf, count); static int put_chars(u32 vtermno, const char *buf, int count) 	if (!port) 		return -EPIPE;  	sg_init_one(sg, buf, count); 	return __send_to_port(port, sg, 1, count, (void *)buf, false); }  /*

Fixed version (after fix):
 static int put_chars(u32 vtermno, const char *buf, int count) { 	struct port *port; 	struct scatterlist sg[1]; 	void *data; 	int ret;  	if (unlikely(early_put_chars)) 		return early_put_chars(vtermno, buf, count); static int put_chars(u32 vtermno, const char *buf, int count) 	if (!port) 		return -EPIPE;  	data = kmemdup(buf, count, GFP_ATOMIC); 	if (!data) 		return -ENOMEM;  	sg_init_one(sg, data, count); 	ret = __send_to_port(port, sg, 1, count, data, false); 	kfree(data); 	return ret; }  /*

Patch:
patch: @@ -1136,6 +1136,8 @@ static int put_chars(u32 vtermno, const char *buf, int count)
 {
 	struct port *port;
 	struct scatterlist sg[1];
+	void *data;
+	int ret;
 
 	if (unlikely(early_put_chars))
 		return early_put_chars(vtermno, buf, count);
@@ -1144,8 +1146,14 @@ static int put_chars(u32 vtermno, const char *buf, int count)
 	if (!port)
 		return -EPIPE;
 
-	sg_init_one(sg, buf, count);
-	return __send_to_port(port, sg, 1, count, (void *)buf, false);
+	data = kmemdup(buf, count, GFP_ATOMIC);
+	if (!data)
+		return -ENOMEM;
+
+	sg_init_one(sg, data, count);
+	ret = __send_to_port(port, sg, 1, count, data, false);
+	kfree(data);
+	return ret;
 }
 
 /*
path: drivers/char/virtio_console.c
Vulnerability: WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.
Vulnerability ID: CVE-2017-8073
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/weechat/weechat
Published: 2017-04-23
File: src/plugins/irc/irc-ctcp.c
Commit message: irc: fix parsing of DCC filename
Commit author: Tobias Stoeckmann

Vulnerable version (before fix):
 irc_ctcp_dcc_filename_without_quotes (const char *filename)     int length;      length = strlen (filename);     if (length > 0)     {         if ((filename[0] == '\"') && (filename[length - 1] == '\"'))             return weechat_strndup (filename + 1, length - 2);

Fixed version (after fix):
 irc_ctcp_dcc_filename_without_quotes (const char *filename)     int length;      length = strlen (filename);     if (length > 1)     {         if ((filename[0] == '\"') && (filename[length - 1] == '\"'))             return weechat_strndup (filename + 1, length - 2);

Patch:
patch: @@ -512,7 +512,7 @@ irc_ctcp_dcc_filename_without_quotes (const char *filename)
     int length;
 
     length = strlen (filename);
-    if (length > 0)
+    if (length > 1)
     {
         if ((filename[0] == '\"') && (filename[length - 1] == '\"'))
             return weechat_strndup (filename + 1, length - 2);
path: src/plugins/irc/irc-ctcp.c
Vulnerability: In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.
Vulnerability ID: CVE-2017-8085
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/exponentcms/exponent-cms
Published: 2017-04-24
File: framework/modules/file/connector/elfinder.php
Commit message: fix possible xss security issue with elFinder (thanks to chengable)
Commit author: dleffler

Vulnerable version (before fix):
 function validName($name) );  //header('Access-Control-Allow-Origin: *'); $connector = new elFinderConnector(new elFinderExponent($opts), true); $connector->run();

Fixed version (after fix):
 function validName($name) );  //header('Access-Control-Allow-Origin: *'); $connector = new elFinderConnector(new elFinderExponent($opts)); $connector->run();

Patch:
patch: @@ -509,5 +509,5 @@ function validName($name)
 );
 
 //header('Access-Control-Allow-Origin: *');
-$connector = new elFinderConnector(new elFinderExponent($opts), true);
+$connector = new elFinderConnector(new elFinderExponent($opts));
 $connector->run();
path: framework/modules/file/connector/elfinder.php