rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.
Vulnerability ID: CVE-2021-40576
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-01-13
File: src/isomedia/hint_track.c
Commit message: fixed #1904
Commit author: jeanlf

Vulnerable version (before fix):
 Bool IsHintTrack(GF_TrackBox *trak) u32 GetHintFormat(GF_TrackBox *trak) { 	GF_HintMediaHeaderBox *hmhd = (GF_HintMediaHeaderBox *)trak->Media->information->InfoHeader; 	if (hmhd->type != GF_ISOM_BOX_TYPE_HMHD) 		return 0; 		 	if (!hmhd || !hmhd->subType) {

Fixed version (after fix):
 Bool IsHintTrack(GF_TrackBox *trak) u32 GetHintFormat(GF_TrackBox *trak) { 	GF_HintMediaHeaderBox *hmhd = (GF_HintMediaHeaderBox *)trak->Media->information->InfoHeader; 	if (!hmhd || (hmhd->type != GF_ISOM_BOX_TYPE_HMHD)) 		return 0; 		 	if (!hmhd || !hmhd->subType) {

Patch:
patch: @@ -43,7 +43,7 @@ Bool IsHintTrack(GF_TrackBox *trak)
 u32 GetHintFormat(GF_TrackBox *trak)
 {
 	GF_HintMediaHeaderBox *hmhd = (GF_HintMediaHeaderBox *)trak->Media->information->InfoHeader;
-	if (hmhd->type != GF_ISOM_BOX_TYPE_HMHD)
+	if (!hmhd || (hmhd->type != GF_ISOM_BOX_TYPE_HMHD))
 		return 0;
 		
 	if (!hmhd || !hmhd->subType) {
path: src/isomedia/hint_track.c
Vulnerability: Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute arbitrary SQL queries. Tuleap Community Edition 11.16.99.173, Tuleap Enterprise Edition 11.16-6, and Tuleap Enterprise Edition 11.15-8 contain a patch for this issue.
Vulnerability ID: CVE-2021-41147
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/Enalean/tuleap
Published: 2021-10-15
File: plugins/cardwall/include/OnTop/ColumnMappingFieldValueDao.class.php
Commit message: request #15131: SQL injection in the planning edition panel

Change-Id: Ifa9971534640010198196f34544f97eb8c7cc9c9
Commit author: Thomas Gerbet

Vulnerable version (before fix):
 <?php /**  * Copyright (c) Enalean, 2012. All Rights Reserved.  *  * This file is a part of Tuleap.  * public function save($cardwall_tracker_id, $tracker_id, $field_id, $value_id, $c     {         $cardwall_tracker_id = $this->da->escapeInt($cardwall_tracker_id);         $tracker_id          = $this->da->escapeInt($tracker_id);         if ($field_id === null) {             $field_id = " NULL ";         } else {

Fixed version (after fix):
 <?php /**  * Copyright (c) Enalean, 2012-Present. All Rights Reserved.  *  * This file is a part of Tuleap.  * public function save($cardwall_tracker_id, $tracker_id, $field_id, $value_id, $c     {         $cardwall_tracker_id = $this->da->escapeInt($cardwall_tracker_id);         $tracker_id          = $this->da->escapeInt($tracker_id);         $value_id            = $this->da->escapeInt($value_id);         $column_id           = $this->da->escapeInt($column_id);         if ($field_id === null) {             $field_id = " NULL ";         } else {

Patch:
patch: @@ -1,6 +1,6 @@
 <?php
 /**
- * Copyright (c) Enalean, 2012. All Rights Reserved.
+ * Copyright (c) Enalean, 2012-Present. All Rights Reserved.
  *
  * This file is a part of Tuleap.
  *
@@ -35,6 +35,8 @@ public function save($cardwall_tracker_id, $tracker_id, $field_id, $value_id, $c
     {
         $cardwall_tracker_id = $this->da->escapeInt($cardwall_tracker_id);
         $tracker_id          = $this->da->escapeInt($tracker_id);
+        $value_id            = $this->da->escapeInt($value_id);
+        $column_id           = $this->da->escapeInt($column_id);
         if ($field_id === null) {
             $field_id = " NULL ";
         } else {
path: plugins/cardwall/include/OnTop/ColumnMappingFieldValueDao.class.php
Vulnerability: Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade. There are no known workarounds for this issue.
Vulnerability ID: CVE-2021-41162
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Combodo/iTop
Published: 2022-04-21
File: application/wizardhelper.class.inc.php
Commit message: N°4362 - XSS in ajax.render.php?operation=wizard_helper on develop
Commit author: acognet

Vulnerable version (before fix):
 public function GetReturnNotEditableFields() 	 */ 	public function GetJsForUpdateFields() 	{ 		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix(); 		//str_replace(['(', ')', ';'], '', $this->m_aData['m_sWizHelperJsVarName']) : 'oWizardHelper'.$this->GetFormPrefix(); 		$sWizardHelperJson = $this->ToJSON();  		return <<<JS

Fixed version (after fix):
 public function GetReturnNotEditableFields() 	 */ 	public function GetJsForUpdateFields() 	{ 		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], '', utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix(); 		$sWizardHelperJson = $this->ToJSON();  		return <<<JS

Patch:
patch: @@ -350,8 +350,7 @@ public function GetReturnNotEditableFields()
 	 */
 	public function GetJsForUpdateFields()
 	{
-		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix();
-		//str_replace(['(', ')', ';'], '', $this->m_aData['m_sWizHelperJsVarName']) : 'oWizardHelper'.$this->GetFormPrefix();
+		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], '', utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix();
 		$sWizardHelperJson = $this->ToJSON();
 
 		return <<<JS
path: application/wizardhelper.class.inc.php
Vulnerability: janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: CVE-2021-4124
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/meetecho/janus-gateway
Published: 2021-12-16
File: html/textroomtest.js
Commit message: Fixed missing XSS mitigation (see #2817)
Commit author: Lorenzo Miniero

Vulnerable version (before fix):
 function sendPrivateMsg(username) { 				text: JSON.stringify(message), 				error: function(reason) { bootbox.alert(reason); }, 				success: function() { 					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + result); 					$('#chatroom').get(0).scrollTop = $('#chatroom').get(0).scrollHeight; 				} 			});

Fixed version (after fix):
 function sendPrivateMsg(username) { 				text: JSON.stringify(message), 				error: function(reason) { bootbox.alert(reason); }, 				success: function() { 					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + escapeXmlTags(result)); 					$('#chatroom').get(0).scrollTop = $('#chatroom').get(0).scrollHeight; 				} 			});

Patch:
patch: @@ -351,7 +351,7 @@ function sendPrivateMsg(username) {
 				text: JSON.stringify(message),
 				error: function(reason) { bootbox.alert(reason); },
 				success: function() {
-					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + result);
+					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + escapeXmlTags(result));
 					$('#chatroom').get(0).scrollTop = $('#chatroom').get(0).scrollHeight;
 				}
 			});
path: html/textroomtest.js
Vulnerability: XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
Vulnerability ID: CVE-2021-41317
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/mandatoryprogrammer/xsshunter-express
Published: 2021-09-17
File: api.js
Commit message: Better path checking
Commit author: Matthew Bryant (mandatory)

Vulnerable version (before fix):
 async function set_up_api_server(app) {             constants.API_BASE_PATH + 'settings',         ];          // If the route is not one of the authentication required routes         // then we can allow it through.         if(!AUTHENTICATION_REQUIRED_ROUTES.includes(req.path)) {             next();             return;         }

Fixed version (after fix):
 async function set_up_api_server(app) {             constants.API_BASE_PATH + 'settings',         ];          // Check if the path being accessed required authentication         var requires_authentication = false;         AUTHENTICATION_REQUIRED_ROUTES.map(authenticated_route => {             if(req.path.toLowerCase().startsWith(authenticated_route)) {                 requires_authentication = true;             }         });          // If the route is not one of the authentication required routes         // then we can allow it through.         if(!requires_authentication) {             next();             return;         }

Patch:
patch: @@ -94,9 +94,17 @@ async function set_up_api_server(app) {
             constants.API_BASE_PATH + 'settings',
         ];
 
+        // Check if the path being accessed required authentication
+        var requires_authentication = false;
+        AUTHENTICATION_REQUIRED_ROUTES.map(authenticated_route => {
+            if(req.path.toLowerCase().startsWith(authenticated_route)) {
+                requires_authentication = true;
+            }
+        });
+
         // If the route is not one of the authentication required routes
         // then we can allow it through.
-        if(!AUTHENTICATION_REQUIRED_ROUTES.includes(req.path)) {
+        if(!requires_authentication) {
             next();
             return;
         }
path: api.js
Vulnerability: DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.
Vulnerability ID: CVE-2021-41689
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/DCMTK/dcmtk
Published: 2022-06-28
File: dcmnet/libsrc/diutil.cc
Commit message: Fixed possible NULL pointer dereference.

Thanks to Jinsheng Ba <bajinsheng@u.nus.edu> for the report and patch.
Commit author: Michael Onken

Vulnerable version (before fix):
 DU_getStringDOElement(DcmItem *obj, DcmTagKey t, char *s, size_t bufsize)             s[0] = '\0';         } else {             ec =  elem->getString(aString);             OFStandard::strlcpy(s, aString, bufsize);         }     }     return (ec == EC_Normal);

Fixed version (after fix):
 DU_getStringDOElement(DcmItem *obj, DcmTagKey t, char *s, size_t bufsize)             s[0] = '\0';         } else {             ec =  elem->getString(aString);             if (ec == EC_Normal)                 OFStandard::strlcpy(s, aString, bufsize);         }     }     return (ec == EC_Normal);

Patch:
patch: @@ -171,7 +171,8 @@ DU_getStringDOElement(DcmItem *obj, DcmTagKey t, char *s, size_t bufsize)
             s[0] = '\0';
         } else {
             ec =  elem->getString(aString);
-            OFStandard::strlcpy(s, aString, bufsize);
+            if (ec == EC_Normal)
+                OFStandard::strlcpy(s, aString, bufsize);
         }
     }
     return (ec == EC_Normal);
path: dcmnet/libsrc/diutil.cc
Vulnerability: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: CVE-2021-4175
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/livehelperchat/livehelperchat
Published: 2021-12-29
File: lhc_web/design/defaulttheme/tpl/lhmobile/settings.tpl.php
Commit message: Missing htmlspecialchars
Commit author: Remigijus Kiminas

Vulnerable version (before fix):
      <div class="form-group">         <label>FCM Key</label>         <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print $mb_options['fcm_key'] : ''?>" />     </div>      <input type="submit" class="btn btn-secondary" name="StoreOptions" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save'); ?>" />

Fixed version (after fix):
      <div class="form-group">         <label>FCM Key</label>         <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print htmlspecialchars($mb_options['fcm_key']) : ''?>" />     </div>      <input type="submit" class="btn btn-secondary" name="StoreOptions" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save'); ?>" />

Patch:
patch: @@ -14,7 +14,7 @@
 
     <div class="form-group">
         <label>FCM Key</label>
-        <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print $mb_options['fcm_key'] : ''?>" />
+        <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print htmlspecialchars($mb_options['fcm_key']) : ''?>" />
     </div>
 
     <input type="submit" class="btn btn-secondary" name="StoreOptions" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save'); ?>" />
path: lhc_web/design/defaulttheme/tpl/lhmobile/settings.tpl.php
Vulnerability: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: CVE-2021-4176
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/livehelperchat/livehelperchat
Published: 2021-12-29
File: lhc_web/design/defaulttheme/tpl/pagelayouts/widget.php
Commit message: Old widget postMessage escape string
Commit author: Remigijus Kiminas

Vulnerable version (before fix):
 	parent.postMessage("lhc_ch:hash_resume:<?php echo $Result['chat']->id,'_',$Result['chat']->hash?>", '*'); 	<?php endif; ?> 	<?php if (isset($Result['additional_post_message'])) : ?> 	parent.postMessage("<?php echo $Result['additional_post_message']?>", '*'); 	<?php endif;?> 	<?php if (isset($Result['parent_messages'])) :  	foreach ($Result['parent_messages'] as $msgPArent) : ?> 	parent.postMessage("<?php echo $msgPArent?>", '*'); 	<?php endforeach;endif;?>      function handleCrossMessage(e) {

Fixed version (after fix):
 	parent.postMessage("lhc_ch:hash_resume:<?php echo $Result['chat']->id,'_',$Result['chat']->hash?>", '*'); 	<?php endif; ?> 	<?php if (isset($Result['additional_post_message'])) : ?> 	parent.postMessage(<?php echo json_encode($Result['additional_post_message'])?>, '*'); 	<?php endif;?> 	<?php if (isset($Result['parent_messages'])) :  	foreach ($Result['parent_messages'] as $msgPArent) : ?> 	parent.postMessage(<?php echo json_encode($msgPArent)?>, '*'); 	<?php endforeach;endif;?>      function handleCrossMessage(e) {

Patch:
patch: @@ -64,11 +64,11 @@
 	parent.postMessage("lhc_ch:hash_resume:<?php echo $Result['chat']->id,'_',$Result['chat']->hash?>", '*');
 	<?php endif; ?>
 	<?php if (isset($Result['additional_post_message'])) : ?>
-	parent.postMessage("<?php echo $Result['additional_post_message']?>", '*');
+	parent.postMessage(<?php echo json_encode($Result['additional_post_message'])?>, '*');
 	<?php endif;?>
 	<?php if (isset($Result['parent_messages'])) : 
 	foreach ($Result['parent_messages'] as $msgPArent) : ?>
-	parent.postMessage("<?php echo $msgPArent?>", '*');
+	parent.postMessage(<?php echo json_encode($msgPArent)?>, '*');
 	<?php endforeach;endif;?>
 
     function handleCrossMessage(e) {
path: lhc_web/design/defaulttheme/tpl/pagelayouts/widget.php
Vulnerability: prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.
Vulnerability ID: CVE-2021-41864
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2021-10-02
File: kernel/bpf/stackmap.c
Commit message: bpf: Fix integer overflow in prealloc_elems_and_freelist()

In prealloc_elems_and_freelist(), the multiplication to calculate the
size passed to bpf_map_area_alloc() could lead to an integer overflow.
As a result, out-of-bounds write could occur in pcpu_freelist_populate()
as reported by KASAN:

[...]
[   16.968613] BUG: KASAN: slab-out-of-bounds in pcpu_freelist_populate+0xd9/0x100
[   16.969408] Write of size 8 at addr ffff888104fc6ea0 by task crash/78
[   16.970038]
[   16.970195] CPU: 0 PID: 78 Comm: crash Not tainted 5.15.0-rc2+ #1
[   16.970878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
[   16.972026] Call Trace:
[   16.972306]  dump_stack_lvl+0x34/0x44
[   16.972687]  print_address_description.constprop.0+0x21/0x140
[   16.973297]  ? pcpu_freelist_populate+0xd9/0x100
[   16.973777]  ? pcpu_freelist_populate+0xd9/0x100
[   16.974257]  kasan_report.cold+0x7f/0x11b
[   16.974681]  ? pcpu_freelist_populate+0xd9/0x100
[   16.975190]  pcpu_freelist_populate+0xd9/0x100
[   16.975669]  stack_map_alloc+0x209/0x2a0
[   16.976106]  __sys_bpf+0xd83/0x2ce0
[...]

The possibility of this overflow was originally discussed in [0], but
was overlooked.

Fix the integer overflow by changing elem_size to u64 from u32.

  [0] https://lore.kernel.org/bpf/728b238e-a481-eb50-98e9-b0f430ab01e7@gmail.com/

Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation")
Signed-off-by: Tatsuhiko Yasumatsu <th.yasumatsu@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210930135545.173698-1-th.yasumatsu@gmail.com
Commit author: Tatsuhiko Yasumatsu

Vulnerable version (before fix):
 static inline int stack_map_data_size(struct bpf_map *map)  static int prealloc_elems_and_freelist(struct bpf_stack_map *smap) { 	u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size; 	int err;  	smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries,

Fixed version (after fix):
 static inline int stack_map_data_size(struct bpf_map *map)  static int prealloc_elems_and_freelist(struct bpf_stack_map *smap) { 	u64 elem_size = sizeof(struct stack_map_bucket) + 			(u64)smap->map.value_size; 	int err;  	smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries,

Patch:
patch: @@ -63,7 +63,8 @@ static inline int stack_map_data_size(struct bpf_map *map)
 
 static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
 {
-	u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size;
+	u64 elem_size = sizeof(struct stack_map_bucket) +
+			(u64)smap->map.value_size;
 	int err;
 
 	smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries,
path: kernel/bpf/stackmap.c
Vulnerability: mruby is vulnerable to NULL Pointer Dereference
Vulnerability ID: CVE-2021-4188
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/mruby/mruby
Published: 2021-12-30
File: src/array.c
Commit message: array.c: fix `mrb_ary_shift_m` initialization bug.

The `ARY_PTR` and `ARY_LEN` may be modified in `mrb_get_args`.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_ary_shift(mrb_state *mrb, mrb_value self) static mrb_value mrb_ary_shift_m(mrb_state *mrb, mrb_value self) {   struct RArray *a = mrb_ary_ptr(self);   mrb_int len = ARY_LEN(a);   mrb_int n;   mrb_value val;    if (mrb_get_args(mrb, "|i", &n) == 0) {     return mrb_ary_shift(mrb, self);   };   ary_modify_check(mrb, a);   if (len == 0 || n == 0) return mrb_ary_new(mrb);   if (n < 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "negative array shift");

Fixed version (after fix):
 mrb_ary_shift(mrb_state *mrb, mrb_value self) static mrb_value mrb_ary_shift_m(mrb_state *mrb, mrb_value self) {   mrb_int n;    if (mrb_get_args(mrb, "|i", &n) == 0) {     return mrb_ary_shift(mrb, self);   }    struct RArray *a = mrb_ary_ptr(self);   mrb_int len = ARY_LEN(a);   mrb_value val;    ary_modify_check(mrb, a);   if (len == 0 || n == 0) return mrb_ary_new(mrb);   if (n < 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "negative array shift");

Patch:
patch: @@ -581,14 +581,16 @@ mrb_ary_shift(mrb_state *mrb, mrb_value self)
 static mrb_value
 mrb_ary_shift_m(mrb_state *mrb, mrb_value self)
 {
-  struct RArray *a = mrb_ary_ptr(self);
-  mrb_int len = ARY_LEN(a);
   mrb_int n;
-  mrb_value val;
 
   if (mrb_get_args(mrb, "|i", &n) == 0) {
     return mrb_ary_shift(mrb, self);
-  };
+  }
+
+  struct RArray *a = mrb_ary_ptr(self);
+  mrb_int len = ARY_LEN(a);
+  mrb_value val;
+
   ary_modify_check(mrb, a);
   if (len == 0 || n == 0) return mrb_ary_new(mrb);
   if (n < 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "negative array shift");
path: src/array.c
Vulnerability: Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
Vulnerability ID: CVE-2021-42325
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/Froxlor/Froxlor
Published: 2021-10-12
File: lib/Froxlor/Database/Manager/DbManagerMySQL.php
Commit message: use prepared statement for creating databases to avoid sql injections in custom db-names

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
Commit author: Michael Kaufmann

Vulnerable version (before fix):
 public function __construct(&$log = null) 	 */ 	public function createDatabase($dbname = null) 	{ 		Database::query("CREATE DATABASE `" . $dbname . "`"); 	}  	/**

Fixed version (after fix):
 public function __construct(&$log = null) 	 */ 	public function createDatabase($dbname = null) 	{ 		$stmt = Database::prepare("CREATE DATABASE :dbname"); 		Database::pexecute($stmt, [ 			'dbname' => $dbname 		]); 	}  	/**

Patch:
patch: @@ -60,7 +60,10 @@ public function __construct(&$log = null)
 	 */
 	public function createDatabase($dbname = null)
 	{
-		Database::query("CREATE DATABASE `" . $dbname . "`");
+		$stmt = Database::prepare("CREATE DATABASE :dbname");
+		Database::pexecute($stmt, [
+			'dbname' => $dbname
+		]);
 	}
 
 	/**
path: lib/Froxlor/Database/Manager/DbManagerMySQL.php
Vulnerability: An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained to preset values).
Vulnerability ID: CVE-2021-43406
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/fusionpbx/fusionpbx
Published: 2021-11-05
File: app/fax/fax_send.php
Commit message: Force the fax_page_size to only preset allowed values.
Commit author: FusionPBX

Vulnerable version (before fix):
 function fax_split_dtmf(&$fax_number, &$fax_dtmf){ 				$page_height = 14; //in 				break; 			case 'letter' : 			default	: 				$page_width = 8.5; //in 				$page_height = 11; //in 		}  		//set resolution

Fixed version (after fix):
 function fax_split_dtmf(&$fax_number, &$fax_dtmf){ 				$page_height = 14; //in 				break; 			case 'letter' : 				$page_width = 8.5; //in 				$page_height = 11; //in 				break; 			default	: 				$page_width = 8.5; //in 				$page_height = 11; //in 				$fax_page_size = 'letter'; 		}  		//set resolution

Patch:
patch: @@ -310,9 +310,13 @@ function fax_split_dtmf(&$fax_number, &$fax_dtmf){
 				$page_height = 14; //in
 				break;
 			case 'letter' :
+				$page_width = 8.5; //in
+				$page_height = 11; //in
+				break;
 			default	:
 				$page_width = 8.5; //in
 				$page_height = 11; //in
+				$fax_page_size = 'letter';
 		}
 
 		//set resolution
path: app/fax/fax_send.php