starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-4087 (published 2022-11-21T07:15Z)

A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through discrepancy. The name of the patch is 186306d6199096b7a7c4b4574d4be8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulnerability.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-203
cwe_name: Observable Discrepancy
description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
         

Fix information:
repo_url: https://github.com/ipxe/ipxe
commit_details: repo_url: https://github.com/ipxe/ipxe
author: Michael Brown
author_date: 2022-11-08 15:10:25+00:00
msg: [tls] Treat invalid block padding as zero length padding

Harden against padding oracle attacks by treating invalid block
padding as zero length padding, thereby deferring the failure until
after computing the (incorrect) MAC.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
repository: repo_url: https://github.com/ipxe/ipxe
repo_name: ipxe/ipxe
description: iPXE network bootloader
repo_language: C
owner: ipxe
file_changes: filename: tls.c
change_type: ModificationType.MODIFY
diff: @@ -2821,8 +2821,8 @@ static int tls_new_ciphertext ( struct tls_connection *tls,
 	if ( is_block_cipher ( cipher ) ) {
 		pad_len = tls_verify_padding ( tls, last );
 		if ( pad_len < 0 ) {
-			rc = pad_len;
-			return rc;
+			/* Assume zero padding length to avoid timing attacks */
+			pad_len = 0;
 		}
 		iob_unput ( last, pad_len );
 		len -= pad_len;

programming_language: C
CVE-2013-4509 (published 2013-11-23T19:55Z)

The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.

Severity: LOW
CVSS v2 base score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-255
cwe_name: Credentials Management Errors
description: Weaknesses in this category are related to the management of credentials.

Fix information:
repo_url: https://github.com/ibus/ibus-anthy
commit_details: repo_url: https://github.com/ibus/ibus-anthy
author: fujiwarat
author_date: 2013-08-30 11:13:31+09:00
msg: Added to check the input purpose for gnome-shell password dialog.
repository: repo_url: https://github.com/ibus/ibus-anthy
repo_name: ibus/ibus-anthy
description: The anthy engine for IBus (github.com/fujiwarat/ibus-anthy:master is a devel repo)
repo_language: Python
owner: ibus
file_changes: filename: engine.py
change_type: ModificationType.MODIFY
diff: @@ -126,6 +126,10 @@ class Engine(IBus.EngineSimple):
         # init state
         self.__idle_id = 0
         self.__prop_dict = {}
+        self.__input_purpose = 0
+        self.__has_input_purpose = False
+        if hasattr(IBus, 'InputPurpose'):
+            self.__has_input_purpose = True
         try:
             self.__is_utf8 = (getpreferredencoding().lower() == 'utf-8')
         except:
@@ -963,11 +967,17 @@ class Engine(IBus.EngineSimple):
             self.__lookup_table.set_page_size(size)
 
     def do_focus_out(self):
+        if self.__has_input_purpose:
+            self.__input_purpose = 0
         mode = self.__prefs.get_value('common', 'behavior_on_focus_out')
         if mode == 0 or mode == 1:
             self.__reset()
             self.__invalidate()
 
+    def do_set_content_type(self, purpose, hints):
+        if self.__has_input_purpose:
+            self.__input_purpose = purpose
+
     def do_disable(self):
         self.__reset()
         self.__invalidate()
@@ -1807,6 +1817,10 @@ class Engine(IBus.EngineSimple):
         return True
 
     def __process_key_event_internal2(self, keyval, keycode, state):
+        if self.__has_input_purpose and \
+           self.__input_purpose == IBus.InputPurpose.PASSWORD:
+            return False
+
         if Engine.__typing_mode == jastring.TYPING_MODE_THUMB_SHIFT and \
            Engine.__input_mode not in [INPUT_MODE_LATIN, INPUT_MODE_WIDE_LATIN]:
             return self.process_key_event_thumb(keyval, keycode, state)

programming_language: Python
CVE-2022-3591 (published 2022-12-02T17:15Z)

Use After Free in GitHub repository vim/vim prior to 9.0.0789.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-10-18 17:05:54+01:00
msg: patch 9.0.0789: dummy buffer ends up in a window

Problem:    Dummy buffer ends up in a window.
Solution:   Disallow navigating to a dummy buffer.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: buffer.c
change_type: ModificationType.MODIFY
diff: @@ -1351,6 +1351,13 @@ do_buffer_ext(
     if ((flags & DOBUF_NOPOPUP) && bt_popup(buf) && !bt_terminal(buf))
 	return OK;
 #endif
+    if ((action == DOBUF_GOTO || action == DOBUF_SPLIT)
+						  && (buf->b_flags & BF_DUMMY))
+    {
+	// disallow navigating to the dummy buffer
+	semsg(_(e_buffer_nr_does_not_exist), count);
+	return FAIL;
+    }
 
 #ifdef FEAT_GUI
     need_mouse_correct = TRUE;

programming_language: C
filename: test_autocmd.vim
change_type: ModificationType.MODIFY
diff: @@ -3857,4 +3857,24 @@ func Test_autocmd_delete()
   call assert_true(autocmd_delete([test_null_dict()]))
 endfunc
 
+func Test_autocmd_split_dummy()
+  " Autocommand trying to split a window containing a dummy buffer.
+  auto BufReadPre * exe "sbuf " .. expand("<abuf>") 
+  " Avoid the "W11" prompt
+  au FileChangedShell * let v:fcs_choice = 'reload'
+  func Xautocmd_changelist()
+    cal writefile(['Xtestfile2:4:4'], 'Xerr')
+    edit Xerr
+    lex 'Xtestfile2:4:4'
+  endfunc
+  call Xautocmd_changelist()
+  call assert_fails('call Xautocmd_changelist()', 'E86:')
+
+  au! BufReadPre
+  au! FileChangedShell
+  delfunc Xautocmd_changelist
+  bwipe! Xerr
+  call delete('Xerr')
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    789,
 /**/
     788,
 /**/

programming_language: Ruby
CVE-2020-20740 (published 2020-11-20T19:15Z)

PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version().

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/enferex/pdfresurrect
commit_details: repo_url: https://github.com/enferex/pdfresurrect
author: Matt Davis
author_date: 2020-07-23 20:18:10-07:00
msg: Update header validation checks.

Thanks to yifengchen-cc for identifying this.
repository: repo_url: https://github.com/enferex/pdfresurrect
repo_name: enferex/pdfresurrect
description: Analyze and help extract older "hidden" versions of a pdf from the current pdf.
repo_language: C
owner: enferex
file_changes: filename: AUTHORS
change_type: ModificationType.MODIFY
diff: @@ -24,3 +24,5 @@ carter-yagemann: Reported and helped isolate a memory issue.
 rootup: Reporting and helped isolate a memory issue.
 
 ZanderChang: Reported and identified bad code in kid page loading.
+
+yifengchen-cc: Reported a header parsing bug.

programming_language: Markdown
filename: pdf.c
change_type: ModificationType.MODIFY
diff: @@ -176,16 +176,13 @@ void pdf_delete(pdf_t *pdf)
 
 int pdf_is_pdf(FILE *fp)
 {
-    int   is_pdf;
     char *header;
+    if (!(header = get_header(fp)))
+      return 0;
 
-    header = get_header(fp);
-
-    if (header && strstr(header, "%PDF-"))
-      is_pdf = 1;
-    else 
-      is_pdf = 0;
-
+    /* First 1024 bytes of doc must be header (1.7 spec pg 1102) */
+    const char *c = strstr(header, "%PDF-");
+    const int is_pdf = c && ((c - header+strlen("%PDF-M.m")) < 1024);
     free(header);
     return is_pdf;
 }
@@ -193,13 +190,16 @@ int pdf_is_pdf(FILE *fp)
 
 void pdf_get_version(FILE *fp, pdf_t *pdf)
 {
-    char *header, *c;
-
-    header = get_header(fp);
+    char *header = get_header(fp);
 
-    /* Locate version string start and make sure we dont go past header */
+    /* Locate version string start and make sure we dont go past header
+     * The format is %PDF-M.m, where 'M' is the major number and 'm' minor.
+     */
+    const char *c;
     if ((c = strstr(header, "%PDF-")) && 
-        (c + strlen("%PDF-M.m") + 2))
+        ((c + 6)[0] == '.') && // Separator
+        isdigit((c + 5)[0]) && // Major number
+        isdigit((c + 7)[0]))   // Minor number
     {
         pdf->pdf_major_version = atoi(c + strlen("%PDF-"));
         pdf->pdf_minor_version = atoi(c + strlen("%PDF-M."));

programming_language: C
CVE-2016-9282 (published 2016-11-11T22:59Z)

SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database information via action=search&module=search with the search_string parameter.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/exponentcms/exponent-cms
commit_details: repo_url: https://github.com/exponentcms/exponent-cms
author: dleffler
author_date: 2016-11-03 09:45:47-04:00
msg: fix security vulnerability in search method, reported by pang0lin
repository: repo_url: https://github.com/exponentcms/exponent-cms
repo_name: exponentcms/exponent-cms
description: Content Management, Simple.
repo_language: PHP
owner: exponentcms
file_changes: filename: searchController.php
change_type: ModificationType.MODIFY
diff: @@ -58,7 +58,7 @@ class searchController extends expController {
         if (get_magic_quotes_gpc()) {
             $terms = stripslashes($terms);
         }
-        $terms = htmlspecialchars($terms);
+        $terms = expString::escape(htmlspecialchars($terms));
 
         if ($router->current_url == substr(URL_FULL, 0, -1)) {  // give us a user friendly url
             unset($router->params['int']);

programming_language: PHP
CVE-2023-51390 (published 2023-12-21T00:15Z)

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-319
cwe_name: Cleartext Transmission of Sensitive Information
description: The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
extended_description: 
	 Many communication channels can be "sniffed" (monitored) by adversaries during data transmission. For example, in networking, packets can traverse many intermediary nodes from the source to the destination, whether across the internet, an internal network, the cloud, etc. Some actors might have privileged access to a network interface or any link along the channel, such as a router, but they might not be authorized to collect the underlying data. As a result, network traffic could be sniffed by adversaries, spilling security-critical data.
	 Applicable communication channels are not limited to software products. Applicable channels include hardware-specific technologies such as internal hardware networks and external debug channels, supporting remote JTAG debugging. When mitigations are not applied to combat adversaries within the product's threat model, this weakness significantly lowers the difficulty of exploitation by such adversaries.
	 When full communications are recorded or logged, such as with a packet dump, an adversary could attempt to obtain the dump long after the transmission has occurred and try to "sniff" the cleartext from the recorded communications in the dump itself. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

         
         

Fix information:
repo_url: https://github.com/Aiven-Open/journalpump
commit_details: repo_url: https://github.com/Aiven-Open/journalpump
author: Josep Prat
author_date: 2023-12-15 15:04:31+01:00
msg: Merge pull request #162 from Aiven-Open/version-250

Updating version and NEWS with last updates since version 2.4.3
repository: repo_url: https://github.com/Aiven-Open/journalpump
repo_name: Aiven-Open/journalpump
description: systemd journald to aws_cloudwatch, elasticsearch, google cloud logging, kafka, rsyslog or logplex log sender
repo_language: Python
owner: Aiven-Open
CVE-2017-10810 (published 2017-07-04T20:29Z)

Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/virtgpu_object.c in the Linux kernel through 4.11.8 allows attackers to cause a denial of service (memory consumption) by triggering object-initialization failures.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-772
cwe_name: Missing Release of Resource after Effective Lifetime
description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
extended_description: When a resource is not released after use, it can allow attackers to cause a denial of service by causing the allocation of resources without triggering their release. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Gerd Hoffmann
author_date: 2017-04-06 17:59:40+02:00
msg: drm/virtio: don't leak bo on drm_gem_object_init failure

Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170406155941.458-1-kraxel@redhat.com
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: virtgpu_object.c
change_type: ModificationType.MODIFY
diff: @@ -81,8 +81,10 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev,
 		return -ENOMEM;
 	size = roundup(size, PAGE_SIZE);
 	ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size);
-	if (ret != 0)
+	if (ret != 0) {
+		kfree(bo);
 		return ret;
+	}
 	bo->dumb = false;
 	virtio_gpu_init_ttm_placement(bo, pinned);
 

programming_language: C
CVE-2016-7537 (published 2017-04-19T14:59Z)

MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted PDB file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-03-07 07:13:10-05:00
msg: https://github.com/ImageMagick/ImageMagick/issues/143
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: pdb.c
change_type: ModificationType.MODIFY
diff: @@ -415,7 +415,7 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
       return(GetFirstImageInList(image));
     }
   packets=(bits_per_pixel*image->columns+7)/8;
-  pixels=(unsigned char *) AcquireQuantumMemory(packets+256UL,image->rows*
+  pixels=(unsigned char *) AcquireQuantumMemory(packets+257UL,image->rows*
     sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -823,7 +823,7 @@ static MagickBooleanType WritePDBImage(const ImageInfo *image_info,Image *image,
     image->rows*sizeof(*runlength));
   if (runlength == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
-  buffer=(unsigned char *) AcquireQuantumMemory(256,sizeof(*buffer));
+  buffer=(unsigned char *) AcquireQuantumMemory(257,sizeof(*buffer));
   if (buffer == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
   packet_size=(size_t) (image->depth > 8 ? 2: 1);

programming_language: Objective-C
CVE-2023-4459 (published 2023-08-21T19:15Z)

A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Zixuan Fu
author_date: 2022-05-14 13:07:11+08:00
msg: net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()

In vmxnet3_rq_create(), when dma_alloc_coherent() fails,
vmxnet3_rq_destroy() is called. It sets rq->rx_ring[i].base to NULL. Then
vmxnet3_rq_create() returns an error to its callers mxnet3_rq_create_all()
-> vmxnet3_change_mtu(). Then vmxnet3_change_mtu() calls
vmxnet3_force_close() -> dev_close() in error handling code. And the driver
calls vmxnet3_close() -> vmxnet3_quiesce_dev() -> vmxnet3_rq_cleanup_all()
-> vmxnet3_rq_cleanup(). In vmxnet3_rq_cleanup(),
rq->rx_ring[ring_idx].base is accessed, but this variable is NULL, causing
a NULL pointer dereference.

To fix this possible bug, an if statement is added to check whether
rq->rx_ring[0].base is NULL in vmxnet3_rq_cleanup() and exit early if so.

The error log in our fault-injection testing is shown as follows:

[   65.220135] BUG: kernel NULL pointer dereference, address: 0000000000000008
...
[   65.222633] RIP: 0010:vmxnet3_rq_cleanup_all+0x396/0x4e0 [vmxnet3]
...
[   65.227977] Call Trace:
...
[   65.228262]  vmxnet3_quiesce_dev+0x80f/0x8a0 [vmxnet3]
[   65.228580]  vmxnet3_close+0x2c4/0x3f0 [vmxnet3]
[   65.228866]  __dev_close_many+0x288/0x350
[   65.229607]  dev_close_many+0xa4/0x480
[   65.231124]  dev_close+0x138/0x230
[   65.231933]  vmxnet3_force_close+0x1f0/0x240 [vmxnet3]
[   65.232248]  vmxnet3_change_mtu+0x75d/0x920 [vmxnet3]
...

Fixes: d1a890fa37f27 ("net: VMware virtual Ethernet NIC driver: vmxnet3")
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Zixuan Fu <r33s3n6@gmail.com>
Link: https://lore.kernel.org/r/20220514050711.2636709-1-r33s3n6@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: vmxnet3_drv.c
change_type: ModificationType.MODIFY
diff: @@ -1668,6 +1668,10 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq,
 	u32 i, ring_idx;
 	struct Vmxnet3_RxDesc *rxd;
 
+	/* ring has already been cleaned up */
+	if (!rq->rx_ring[0].base)
+		return;
+
 	for (ring_idx = 0; ring_idx < 2; ring_idx++) {
 		for (i = 0; i < rq->rx_ring[ring_idx].size; i++) {
 #ifdef __BIG_ENDIAN_BITFIELD

programming_language: C
CVE-2020-26224 (published 2020-11-16T22:15Z)

In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: GoT
author_date: 2020-11-16 10:47:20+01:00
msg: Merge pull request from GHSA-frf2-c9q3-qg9m

Make sure the user is connected before submit reorder
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop