starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-42451 (published 2023-09-19T16:15Z)

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-706
cwe_name: Use of Incorrectly-Resolved Name or Reference
description: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mastodon/mastodon
commit_details: repo_url: https://github.com/mastodon/mastodon
author: Claire
author_date: 2023-09-19 16:53:58+02:00
msg: Merge pull request from GHSA-v3xf-c9qf-j667
repository: repo_url: https://github.com/mastodon/mastodon
repo_name: mastodon/mastodon
description: Your self-hosted, globally interconnected microblogging community
repo_language: Ruby
owner: mastodon
file_changes: filename: tag_manager.rb
change_type: ModificationType.MODIFY
diff: @@ -7,18 +7,18 @@ class TagManager
   include RoutingHelper
 
   def web_domain?(domain)
-    domain.nil? || domain.delete('/').casecmp(Rails.configuration.x.web_domain).zero?
+    domain.nil? || domain.delete_suffix('/').casecmp(Rails.configuration.x.web_domain).zero?
   end
 
   def local_domain?(domain)
-    domain.nil? || domain.delete('/').casecmp(Rails.configuration.x.local_domain).zero?
+    domain.nil? || domain.delete_suffix('/').casecmp(Rails.configuration.x.local_domain).zero?
   end
 
   def normalize_domain(domain)
     return if domain.nil?
 
     uri = Addressable::URI.new
-    uri.host = domain.delete('/')
+    uri.host = domain.delete_suffix('/')
     uri.normalized_host
   end
 

programming_language: Ruby
CVE-2015-4700 (published 2015-08-31T10:59Z)

The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-17
cwe_name: DEPRECATED: Code
description: This entry has been deprecated.  It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Alexei Starovoitov
author_date: 2015-05-22 15:42:55-07:00
msg: x86: bpf_jit: fix compilation of large bpf programs

x86 has variable length encoding. x86 JIT compiler is trying
to pick the shortest encoding for given bpf instruction.
While doing so the jump targets are changing, so JIT is doing
multiple passes over the program. Typical program needs 3 passes.
Some very short programs converge with 2 passes. Large programs
may need 4 or 5. But specially crafted bpf programs may hit the
pass limit and if the program converges on the last iteration
the JIT compiler will be producing an image full of 'int 3' insns.
Fix this corner case by doing final iteration over bpf program.

Fixes: 0a14842f5a3c ("net: filter: Just In Time compiler for x86-64")
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Tested-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: bpf_jit_comp.c
change_type: ModificationType.MODIFY
diff: @@ -966,7 +966,12 @@ void bpf_int_jit_compile(struct bpf_prog *prog)
 	}
 	ctx.cleanup_addr = proglen;
 
-	for (pass = 0; pass < 10; pass++) {
+	/* JITed image shrinks with every pass and the loop iterates
+	 * until the image stops shrinking. Very large bpf programs
+	 * may converge on the last pass. In such case do one more
+	 * pass to emit the final image
+	 */
+	for (pass = 0; pass < 10 || image; pass++) {
 		proglen = do_jit(prog, addrs, image, oldproglen, &ctx);
 		if (proglen <= 0) {
 			image = NULL;

programming_language: C
CVE-2023-25673 (published 2023-03-25T00:15Z)

TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a Floating Point Exception in TensorListSplit with XLA. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-697
cwe_name: Incorrect Comparison
description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
extended_description: 
            This Pillar covers several possibilities:
               
                  the comparison checks one factor incorrectly;
                  the comparison should consider multiple factors, but it does not check at least one of those factors at all;
                  the comparison checks the wrong factor.
               
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Jian Cai
author_date: 2023-02-01 15:35:07-08:00
msg: [Tensorflow] Fix security vulnerability with TensorListSplitOp

PiperOrigin-RevId: 506441188
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: tensor_list_ops_test.py
change_type: ModificationType.MODIFY
diff: @@ -236,6 +236,17 @@ class ListOpsTest(parameterized.TestCase, xla_test.XLATestCase):
       self.assertAllEqual(z.shape.as_list(), [None])
       self.assertAllEqual(z, [0.0, 0.0])
 
+  def testInvalidSplitLength(self):
+    with self.session(), self.test_scope():
+      tensor_list_split = list_ops.tensor_list_split(
+          tensor=[1], element_shape=[-1], lengths=[0]
+      )
+      with self.assertRaisesRegex(
+          errors.UnimplementedError, "All lengths must be positive"
+      ):
+        self.evaluate(tensor_list_split)
+
+
 if __name__ == "__main__":
   os.environ["TF_XLA_FLAGS"] = ("--tf_xla_min_cluster_size=2 " +
                                 os.environ.get("TF_XLA_FLAGS", ""))

programming_language: Python
filename: tensor_list_ops.cc
change_type: ModificationType.MODIFY
diff: @@ -553,6 +553,8 @@ class TensorListSplitOp : public XlaOpKernel {
       OP_REQUIRES(ctx, len == length,
                   errors::Unimplemented("All lengths have to be the same"));
     }
+    OP_REQUIRES(ctx, length,
+                errors::Unimplemented("All lengths must be positive"));
     OP_REQUIRES(
         ctx, element_dims[0] % length == 0,
         errors::Unimplemented("Buffer size has to be a multiple of length"));

programming_language: C++
CVE-2016-5352 (published 2016-08-07T16:59Z)

epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/wireshark/wireshark
commit_details: repo_url: https://github.com/wireshark/wireshark
author: Michael Mann
author_date: 2016-05-09 20:41:45-04:00
msg: Sanity check eapol_len in AirPDcapDecryptWPABroadcastKey

Bug: 12175
Change-Id: Iaf977ba48f8668bf8095800a115ff9a3472dd893
Reviewed-on: https://code.wireshark.org/review/15326
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Peter Wu <peter@lekensteyn.nl>
repository: repo_url: https://github.com/wireshark/wireshark
repo_name: wireshark/wireshark
description: Read-only mirror of Wireshark's Git repository at https://gitlab.com/wireshark/wireshark. ⚠️ GitHub won't let us disable pull requests. ⚠️ THEY WILL BE IGNORED HERE ⚠️ Upload them at GitLab instead.
repo_language: C
owner: wireshark
file_changes: filename: airpdcap.c
change_type: ModificationType.MODIFY
diff: @@ -351,7 +351,9 @@ AirPDcapDecryptWPABroadcastKey(const EAPOL_RSN_KEY *pEAPKey, guint8 *decryption_
         }
     }
 
-    if (key_bytes_len < GROUP_KEY_MIN_LEN || key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY)) {
+    if ((key_bytes_len < GROUP_KEY_MIN_LEN) ||
+        (eapol_len < sizeof(EAPOL_RSN_KEY)) ||
+        (key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY))) {
         return AIRPDCAP_RET_NO_VALID_HANDSHAKE;
     }
 

programming_language: C
CVE-2018-3728 (published 2018-03-30T19:29Z)

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via \'merge\' and \'applyToDefaults\' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-471
cwe_name: Modification of Assumed-Immutable Data (MAID)
description: The product does not properly protect an assumed-immutable element from being modified by an attacker.
extended_description: This occurs when a particular input is critical enough to the functioning of the application that it should not be modifiable at all, but it is. Certain resources are often assumed to be immutable when they are not, such as hidden form fields in web applications, cookies, and reverse DNS lookups.
         

Fix information:
repo_url: https://github.com/hapijs/hoek
commit_details: repo_url: https://github.com/hapijs/hoek
author: Nathan LaFreniere
author_date: 2018-02-06 09:55:01-08:00
msg: skip assignment to __proto__
repository: repo_url: https://github.com/hapijs/hoek
repo_name: hapijs/hoek
description: Node utilities shared among the extended hapi universe
repo_language: JavaScript
owner: hapijs
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -115,6 +115,10 @@ exports.merge = function (target, source, isNullOverride /* = true */, isMergeAr
     const keys = Object.keys(source);
     for (let i = 0; i < keys.length; ++i) {
         const key = keys[i];
+        if (key === '__proto__') {
+            continue;
+        }
+
         const value = source[key];
         if (value &&
             typeof value === 'object') {

programming_language: JavaScript
filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -585,6 +585,15 @@ describe('merge()', () => {
         Hoek.merge({ x: {} }, a);
         expect(a.x.toString()).to.equal('abc');
     });
+
+    it('skips __proto__', () => {
+
+        const a = '{ "ok": "value", "__proto__": { "test": "value" } }';
+
+        const b = Hoek.merge({}, JSON.parse(a));
+        expect(b).to.equal({ ok: 'value' });
+        expect(b.test).to.equal(undefined);
+    });
 });
 
 describe('applyToDefaults()', () => {

programming_language: TypeScript
CVE-2022-0676 (published 2022-02-22T00:15Z)

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: pancake
author_date: 2022-02-18 00:58:43+01:00
msg: Fix heap buffer overflow in dyldcache parser ##crash

* Reported by: Lazymio via huntr.dev
* Reproducer: dyldovf
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: bin_dyldcache.c
change_type: ModificationType.MODIFY
diff: @@ -1144,6 +1144,8 @@ static ut64 resolve_symbols_off(RDyldCache *cache, ut64 pa) {
 
 static RList *create_cache_bins(RBinFile *bf, RDyldCache *cache) {
 	RList *bins = r_list_newf ((RListFree)free_bin);
+	ut16 *depArray = NULL;
+	cache_imgxtr_t *extras = NULL;
 	if (!bins) {
 		return NULL;
 	}
@@ -1177,8 +1179,6 @@ static RList *create_cache_bins(RBinFile *bf, RDyldCache *cache) {
 		}
 
 		ut32 j;
-		ut16 *depArray = NULL;
-		cache_imgxtr_t *extras = NULL;
 		if (target_libs) {
 			HtPU *path_to_idx = NULL;
 			if (cache->accel) {
@@ -1734,12 +1734,12 @@ static void populate_cache_maps(RDyldCache *cache) {
 	cache->n_maps = next_map;
 }
 
-static cache_accel_t *read_cache_accel(RBuffer *cache_buf, cache_hdr_t *hdr, cache_map_t *maps) {
+static cache_accel_t *read_cache_accel(RBuffer *cache_buf, cache_hdr_t *hdr, cache_map_t *maps, int n_maps) {
 	if (!cache_buf || !hdr || !hdr->accelerateInfoSize || !hdr->accelerateInfoAddr) {
 		return NULL;
 	}
-
-	ut64 offset = va2pa (hdr->accelerateInfoAddr, hdr->mappingCount, maps, cache_buf, 0, NULL, NULL);
+	size_t mc = R_MIN (hdr->mappingCount, n_maps);
+	ut64 offset = va2pa (hdr->accelerateInfoAddr, mc, maps, cache_buf, 0, NULL, NULL);
 	if (!offset) {
 		return NULL;
 	}
@@ -1895,7 +1895,7 @@ static bool load_buffer(RBinFile *bf, void **bin_obj, RBuffer *buf, ut64 loadadd
 		r_dyldcache_free (cache);
 		return false;
 	}
-	cache->accel = read_cache_accel (cache->buf, cache->hdr, cache->maps);
+	cache->accel = read_cache_accel (cache->buf, cache->hdr, cache->maps, cache->n_maps);
 	cache->bins = create_cache_bins (bf, cache);
 	if (!cache->bins) {
 		r_dyldcache_free (cache);

programming_language: C
CVE-2020-36254 (published 2021-02-25T09:15Z)

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mkj/dropbear
commit_details: repo_url: https://github.com/mkj/dropbear
author: Haelwenn Monnier
author_date: 2020-05-25 14:54:29+02:00
msg: scp.c: Port OpenSSH CVE-2018-20685 fix (#80)
repository: repo_url: https://github.com/mkj/dropbear
repo_name: mkj/dropbear
description: Dropbear SSH
repo_language: C
owner: mkj
file_changes: filename: scp.c
change_type: ModificationType.MODIFY
diff: @@ -935,7 +935,8 @@ sink(int argc, char **argv)
 			size = size * 10 + (*cp++ - '0');
 		if (*cp++ != ' ')
 			SCREWUP("size not delimited");
-		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
+		if (*cp == '\0' || strchr(cp, '/') != NULL ||
+		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
 			run_err("error: unexpected filename: %s", cp);
 			exit(1);
 		}

programming_language: C
CVE-2018-14474 (published 2018-07-20T18:29Z)

views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/s-gv/orangeforum
commit_details: repo_url: https://github.com/s-gv/orangeforum
author: Sagar Gubbi
author_date: 2018-03-04 00:37:49+05:30
msg: Fix open redirection
repository: repo_url: https://github.com/s-gv/orangeforum
repo_name: s-gv/orangeforum
description: A light-weight forum
repo_language: Go
owner: s-gv
file_changes: filename: auth.go
change_type: ModificationType.MODIFY
diff: @@ -20,7 +20,7 @@ import (
 
 var LoginHandler = UA(func(w http.ResponseWriter, r *http.Request, sess Session) {
 	redirectURL, err := url.QueryUnescape(r.FormValue("next"))
-	if redirectURL == "" || err != nil {
+	if err != nil || redirectURL == "" || redirectURL[0] != '/' {
 		redirectURL = "/"
 	}
 	if sess.IsUserValid() {
@@ -59,7 +59,7 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 
 var SignupHandler = UA(func(w http.ResponseWriter, r *http.Request, sess Session) {
 	redirectURL, err := url.QueryUnescape(r.FormValue("next"))
-	if redirectURL == "" || err != nil {
+	if err != nil || redirectURL == "" || redirectURL[0] != '/' {
 		redirectURL = "/"
 	}
 	if sess.IsUserValid() && !sess.IsUserSuperAdmin() {

programming_language: Go
CVE-2017-13012 (published 2017-09-14T06:29Z)

The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-03-15 23:45:38-07:00
msg: CVE-2017-13012/ICMP: Add a missing bounds check.

Check before fetching the length from the included packet's IPv4 header.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-icmp.c
change_type: ModificationType.MODIFY
diff: @@ -581,6 +581,7 @@ icmp_print(netdissect_options *ndo, const u_char *bp, u_int plen, const u_char *
 		ND_PRINT((ndo, "\n\t"));
 		ip = (const struct ip *)bp;
                 snapend_save = ndo->ndo_snapend;
+		ND_TCHECK_16BITS(&ip->ip_len);
 		ip_print(ndo, bp, EXTRACT_16BITS(&ip->ip_len));
                 ndo->ndo_snapend = snapend_save;
 	}

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -509,6 +509,7 @@ pktap-heap-overflow	pktap-heap-overflow.pcap	pktap-heap-overflow.out	-v
 
 # bad packets from Bhargava Shastry
 lldp_asan		lldp_asan.pcap			lldp_asan.out	-v
+extract_read2_asan	extract_read2_asan.pcap		extract_read2_asan.out	-v
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: extract_read2_asan.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,3 @@
+IP (tos 0x14, id 1, offset 0, flags [none], proto ICMP (1), length 512, options (unknown 3,unknown 3,unknown 3 [bad length 3]), bad cksum 3ff (->b4bd)!)
+    240.25.0.0 > 3.3.3.3: ICMP source quench, length 484
+	[|icmp]

programming_language: Batchfile
CVE-2022-0504 (published 2022-02-08T09:15Z)

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-209
cwe_name: Generation of Error Message Containing Sensitive Information
description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
extended_description: The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks. The error message may be created in different ways:
           
             self-generated: the source code explicitly constructs the error message and delivers it
	     externally-generated: the external environment, such as a language interpreter, handles the error and constructs its own message, whose contents are not under direct control by the programmer
	   
	 An attacker may use the contents of error messages to help launch another, more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Bozhidar Slaveykov
author_date: 2022-02-03 14:39:28+02:00
msg: update
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: restore.js
change_type: ModificationType.MODIFY
diff: @@ -154,6 +154,10 @@ mw.restore = {
 			}
 
 			if (json_data.done) {
+
+                mw.restore.reload_mw_db();
+                mw.clear_cache();
+
 				mw.restore.get_progress(100);
 				mw.restore.get_log_check('stop');
 				//mw.spinner({element: ".button-start", size: 30, color: 'white'}).hide()
@@ -177,6 +181,11 @@ mw.restore = {
 		});
 	},
 
+    reload_mw_db: function () {
+        $.post(mw.settings.api_url + 'mw_post_update');
+        mw.notification.success("The DB was reloaded");
+    }, 
+
 	get_log_check: function(action = 'start') {
 
 		var importLogInterval = setInterval(function() {

programming_language: JavaScript
filename: api.js
change_type: ModificationType.MODIFY
diff: @@ -555,6 +555,8 @@ mw.getScripts = function (array, callback) {
       }
     });
   }
+
+
   mw.temp_reload_module_queue_holder = [];
 
 

programming_language: JavaScript