starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-48123 (published 2023-12-06T20:15Z)

An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/pfsense/pfsense
commit_details: repo_url: https://github.com/pfsense/pfsense
author: jim-p
author_date: 2023-09-25 10:59:01-04:00
msg: Pcap: Validate+Encode count & length. Fixes #14809
repository: repo_url: https://github.com/pfsense/pfsense
repo_name: pfsense/pfsense
description: Main repository for pfSense
repo_language: PHP
owner: pfsense
file_changes: filename: diag_packet_capture.php
change_type: ModificationType.MODIFY
diff: @@ -119,10 +119,20 @@ if ($_POST) {
 	$input_filter = ($_POST['filter'] !== null) ? intval($_POST['filter']) : null;
 	if ($_POST['count'] == '0') {
 		$input_count = 0;
+	} elseif (empty($_POST['count'])) {
+		$input_count = 1000;
+	} elseif (!is_numericint($_POST['count'])) {
+		$input_error[] = 'Invalid Packet Count.';
 	} else {
-		$input_count = empty($_POST['count']) ? 1000 : $_POST['count'];
+		$input_count = intval($_POST['count']);
+	}
+	if (empty($_POST['length'])) {
+		$input_length = 0;
+	} elseif (!is_numericint($_POST['length'])) {
+		$input_error[] = 'Invalid Packet Length.';
+	} else {
+		$input_length = intval($_POST['length']);
 	}
-	$input_length = empty($_POST['length']) ? 0 : $_POST['length'];
 	$input_promiscuous = empty($_POST['promiscuous']) ? false : $_POST['promiscuous'];
 	// view options
 	$input_viewdetail = empty($_POST['viewdetail']) ? 'normal' : $_POST['viewdetail'];
@@ -759,8 +769,8 @@ if ($action == 'stop' || $action == 'view' || $process_running || $run_capture)
 
 		// Handle capture options
 		$cmd_part_promiscuous = $input_promiscuous ? '' : ' -p';
-		$cmd_part_count = empty($input_count) ? '' : " -c {$input_count}";
-		$cmd_part_length = empty($input_length) ? '' : " -s {$input_length}";
+		$cmd_part_count = empty($input_count) ? '' : " -c " . escapeshellarg($input_count);
+		$cmd_part_length = empty($input_length) ? '' : " -s " . escapeshellarg($input_length);
 		$cmd_expression_string = $expression_string ? escapeshellarg($expression_string) : '';
 
 		/* Output in binary format (use packet-buffered to avoid missing packets) to stdout,

programming_language: PHP
CVE-2017-13139 (published 2017-08-23T06:29Z)

In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Glenn Randers-Pehrson
author_date: 2017-07-09 22:42:32-04:00
msg: Skip MNG CLIP chunk with out-of-range object IDs
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: png.c
change_type: ModificationType.MODIFY
diff: @@ -5899,6 +5899,9 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
 
                 for (i=(int) first_object; i <= (int) last_object; i++)
                 {
+                  if ((i < 0) || (i >= MNG_MAX_OBJECTS))
+                    continue;
+
                   if (mng_info->exists[i] && !mng_info->frozen[i])
                     {
                       MngBox

programming_language: C
CVE-2022-1033 (published 2022-03-23T08:15Z)

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/crater-invoice/crater
commit_details: repo_url: https://github.com/crater-invoice/crater
author: theWorstComrade
author_date: 2022-03-22 12:28:55+01:00
msg: Expense attachment validation fix (#855)

https://huntr.dev/bounties/4d7d4fc9-e0cf-42d3-b89c-6ea57a769045/
repository: repo_url: https://github.com/crater-invoice/crater
repo_name: crater-invoice/crater
description: Open Source Invoicing Solution for Individuals & Businesses
repo_language: PHP
owner: crater-invoice
file_changes: filename: UploadExpenseReceiptRequest.php
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,7 @@ class UploadExpenseReceiptRequest extends FormRequest
     public function rules()
     {
         return [
-            'upload_receipt' => [
+            'attachment_receipt' => [
                 'nullable',
                 new Base64Mime(['gif', 'jpg', 'png'])
             ]

programming_language: PHP
CVE-2013-4512 (published 2013-11-12T14:35Z)

Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.

Severity: MEDIUM
CVSS v2 base score: 4.7 (AV:L/AC:M/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Dan Carpenter
author_date: 2013-10-29 22:06:04+03:00
msg: uml: check length in exitcode_proc_write()

We don't cap the size of buffer from the user so we could write past the
end of the array here.  Only root can write to this file.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: exitcode.c
change_type: ModificationType.MODIFY
diff: @@ -40,9 +40,11 @@ static ssize_t exitcode_proc_write(struct file *file,
 		const char __user *buffer, size_t count, loff_t *pos)
 {
 	char *end, buf[sizeof("nnnnn\0")];
+	size_t size;
 	int tmp;
 
-	if (copy_from_user(buf, buffer, count))
+	size = min(count, sizeof(buf));
+	if (copy_from_user(buf, buffer, size))
 		return -EFAULT;
 
 	tmp = simple_strtol(buf, &end, 0);

programming_language: C
CVE-2018-12248 (published 2018-06-12T14:29Z)

An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/mruby/mruby
commit_details: repo_url: https://github.com/mruby/mruby
author: Yukihiro "Matz" Matsumoto
author_date: 2018-06-07 15:59:00+09:00
msg: Extend stack when pushing arguments that does not fit in; fix #4038
repository: repo_url: https://github.com/mruby/mruby
repo_name: mruby/mruby
description: Lightweight Ruby
repo_language: C
owner: mruby
file_changes: filename: fiber.c
change_type: ModificationType.MODIFY
diff: @@ -184,26 +184,27 @@ fiber_switch(mrb_state *mrb, mrb_value self, mrb_int len, const mrb_value *a, mr
 {
   struct mrb_context *c = fiber_check(mrb, self);
   struct mrb_context *old_c = mrb->c;
+  enum mrb_fiber_state status;
   mrb_value value;
 
   fiber_check_cfunc(mrb, c);
-  if (resume && c->status == MRB_FIBER_TRANSFERRED) {
+  status = c->status;
+  if (resume && status == MRB_FIBER_TRANSFERRED) {
     mrb_raise(mrb, E_FIBER_ERROR, "resuming transferred fiber");
   }
-  if (c->status == MRB_FIBER_RUNNING || c->status == MRB_FIBER_RESUMED) {
+  if (status == MRB_FIBER_RUNNING || status == MRB_FIBER_RESUMED) {
     mrb_raise(mrb, E_FIBER_ERROR, "double resume (fib)");
   }
-  if (c->status == MRB_FIBER_TERMINATED) {
+  if (status == MRB_FIBER_TERMINATED) {
     mrb_raise(mrb, E_FIBER_ERROR, "resuming dead fiber");
   }
-  mrb->c->status = resume ? MRB_FIBER_RESUMED : MRB_FIBER_TRANSFERRED;
+  old_c->status = resume ? MRB_FIBER_RESUMED : MRB_FIBER_TRANSFERRED;
   c->prev = resume ? mrb->c : (c->prev ? c->prev : mrb->root_c);
-  if (c->status == MRB_FIBER_CREATED) {
+  fiber_switch_context(mrb, c);
+  if (status == MRB_FIBER_CREATED) {
     mrb_value *b, *e;
 
-    if (len >= c->stend - c->stack) {
-      mrb_raise(mrb, E_FIBER_ERROR, "too many arguments to fiber");
-    }
+    mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
     b = c->stack+1;
     e = b + len;
     while (b<e) {
@@ -215,7 +216,6 @@ fiber_switch(mrb_state *mrb, mrb_value self, mrb_int len, const mrb_value *a, mr
   else {
     value = fiber_result(mrb, a, len);
   }
-  fiber_switch_context(mrb, c);
 
   if (vmexec) {
     c->vmexec = TRUE;

programming_language: C
CVE-2021-37847 (published 2021-08-02T20:15Z)

crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/saschahauer/barebox
commit_details: repo_url: https://github.com/saschahauer/barebox
author: Sascha Hauer
author_date: 2021-03-05 09:27:22+01:00
msg: crypto: digest: use crypto_memneq()

When verifying a digest it is important not to leak timing information
through memcmp(). Use crypto_memneq() instead.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
repository: repo_url: https://github.com/saschahauer/barebox
repo_name: barebox/barebox
description: The barebox bootloader - Mirror of ssh://public@git.pengutronix.de/barebox
repo_language: C
owner: saschahauer
file_changes: filename: digest.c
change_type: ModificationType.MODIFY
diff: @@ -22,6 +22,7 @@
 #include <errno.h>
 #include <module.h>
 #include <linux/err.h>
+#include <crypto.h>
 #include <crypto/internal.h>
 
 static LIST_HEAD(digests);
@@ -47,8 +48,10 @@ int digest_generic_verify(struct digest *d, const unsigned char *md)
 	if (ret)
 		goto end;
 
-	ret = memcmp(md, tmp, len);
-	ret = ret ? -EINVAL : 0;
+	if (crypto_memneq(md, tmp, len))
+		ret = -EINVAL;
+	else
+		ret = 0;
 end:
 	free(tmp);
 	return ret;

programming_language: C
CVE-2020-5243 (published 2020-02-21T00:15Z)

uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/ua-parser/uap-core
commit_details: repo_url: https://github.com/ua-parser/uap-core
author: commenthol
author_date: 2020-02-20 18:46:44+01:00
msg: Merge pull request from GHSA-cmcx-xhr8-3w9p

Advisory fix 1
repository: repo_url: https://github.com/ua-parser/uap-core
repo_name: ua-parser/uap-core
description: The regex file necessary to build language ports of Browserscope's user agent parser.
repo_language: JavaScript
owner: ua-parser
CVE-2022-2526 (published 2022-09-09T15:15Z)

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/systemd/systemd
commit_details: repo_url: https://github.com/systemd/systemd
author: Lennart Poettering
author_date: 2018-12-04 22:13:39+01:00
msg: resolved: pin stream while calling callbacks for it

These callbacks might unref the stream, but we still have to access it,
let's hence ref it explicitly.

Maybe fixes: #10725
repository: repo_url: https://github.com/systemd/systemd
repo_name: systemd/systemd
description: The systemd System and Service Manager 
repo_language: C
owner: systemd
file_changes: filename: resolved-dns-stream.c
change_type: ModificationType.MODIFY
diff: @@ -46,6 +46,8 @@ static int dns_stream_update_io(DnsStream *s) {
 }
 
 static int dns_stream_complete(DnsStream *s, int error) {
+        _cleanup_(dns_stream_unrefp) _unused_ DnsStream *ref = dns_stream_ref(s); /* Protect stream while we process it */
+
         assert(s);
 
 #if ENABLE_DNS_OVER_TLS
@@ -273,7 +275,7 @@ static int on_stream_timeout(sd_event_source *es, usec_t usec, void *userdata) {
 }
 
 static int on_stream_io(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
-        DnsStream *s = userdata;
+        _cleanup_(dns_stream_unrefp) DnsStream *s = dns_stream_ref(userdata); /* Protect stream while we process it */
         int r;
 
         assert(s);

programming_language: C
CVE-2020-15277 (published 2020-10-30T18:15Z)

baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/baserproject/basercms
commit_details: repo_url: https://github.com/baserproject/basercms
author: baserproject
author_date: 2020-10-29 11:41:25+09:00
msg: Merge pull request from GHSA-6fmv-q269-55cw

fix #1531 1532 1533 #1534 管理画面の文字列出力を改善
repository: repo_url: https://github.com/baserproject/basercms
repo_name: baserproject/basercms
description: baserCMS :  Based Website Development Project
repo_language: PHP
owner: baserproject
CVE-2021-29562 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.IRFFT`. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-05-04 17:11:46-07:00
msg: Fix a check fail in Fast Fourier implementation

PiperOrigin-RevId: 372026629
Change-Id: Id05c3362aa575271bc3e06b16316c9037085fc11
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: fft_ops.cc
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 ==============================================================================*/
 
+#include "tensorflow/core/platform/errors.h"
 #define EIGEN_USE_THREADS
 
 // See docs in ../ops/fft_ops.cc.
@@ -261,6 +262,9 @@ class FFTCPU : public FFTBase {
           i == FFTRank ? fft_shape[i - 1] / 2 + 1 : fft_shape[i - 1];
       full_fft_shape.AddDim(fft_shape[i - 1]);
     }
+    OP_REQUIRES(ctx, full_fft_shape.num_elements() > 0,
+                errors::InvalidArgument("Obtained a FFT shape of 0 elements: ",
+                                        full_fft_shape.DebugString()));
 
     Tensor temp;
     OP_REQUIRES_OK(ctx, ctx->allocate_temp(DataTypeToEnum<ComplexT>::v(),

programming_language: C++
CVE-2021-43778 (published 2021-11-24T19:15Z)

Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/pluginsGLPI/barcode
commit_details: repo_url: https://github.com/pluginsGLPI/barcode
author: Alexandre Delaunay
author_date: 2021-11-08 11:27:21+01:00
msg: die on insecure file request, fix #85
repository: repo_url: https://github.com/pluginsGLPI/barcode
repo_name: pluginsGLPI/barcode
repo_language: PHP
owner: pluginsGLPI
file_changes: filename: send.php
change_type: ModificationType.MODIFY
diff: @@ -54,6 +54,7 @@ if (isset($_GET['file'])) {
       echo "Security attack !!!";
       Toolbox::logDebug("[Plugin barcode][security][sendfile] ".
                $_SESSION["glpiname"]." try to get a non standard file : ".$filename);
+      exit;
    }
 
    $file = $docDir.'/'.$filename;

programming_language: PHP