starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-46927 (published 2023-11-01T15:15Z)

GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in gpac/MP4Box.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: Aurelien David
author_date: 2023-10-23 14:17:29+02:00
msg: gf_isom_use_compact_size() check sampleCount!=0 (fixes #2657)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: isom_write.c
change_type: ModificationType.MODIFY
diff: @@ -359,7 +359,7 @@ static GF_Err gf_isom_set_root_iod(GF_ISOFile *movie)
 	GF_IsomInitialObjectDescriptor *iod;
 	GF_IsomObjectDescriptor *od;
 	GF_Err e;
-	
+
 	e = gf_isom_insert_moov(movie);
 	if (e) return e;
 	if (!movie->moov->iods) {
@@ -790,7 +790,7 @@ u32 gf_isom_new_track_from_template(GF_ISOFile *movie, GF_ISOTrackID trakID, u32
 		}
 	}
 	movie->last_created_track_id = tkhd->trackID;
-	
+
 	if (!movie->keep_utc && !gf_sys_is_test_mode() ) {
 		tkhd->modificationTime = now;
 	 	mdia->mediaHeader->modificationTime = now;
@@ -3395,7 +3395,7 @@ GF_Err gf_isom_use_compact_size(GF_ISOFile *movie, u32 trackNumber, Bool Compact
 	//fill the table. Although it seems weird , this is needed in case of edition
 	//after the function is called. NOte however than we force regular table
 	//at write time if all samples are of same size
-	if (stsz->sampleSize) {
+	if (stsz->sampleSize && stsz->sampleCount) {
 		//this is a weird table indeed ;)
 		if (stsz->sizes) gf_free(stsz->sizes);
 		stsz->sizes = (u32*) gf_malloc(sizeof(u32)*stsz->sampleCount);
@@ -6313,7 +6313,7 @@ GF_Err gf_isom_apple_set_tag(GF_ISOFile *mov, GF_ISOiTunesTag tag, const u8 *dat
 		return GF_OK;
 	}
 	if (!ilst->child_boxes) ilst->child_boxes = gf_list_new();
-	
+
 	return gf_list_add(ilst->child_boxes, info);
 }
 
@@ -6975,7 +6975,7 @@ static GF_SampleGroupDescriptionBox *get_sgdp(GF_SampleTableBox *stbl, void *tra
 			sgdesc = NULL;
 		}
 	}
-	
+
 #ifndef GPAC_DISABLE_ISOM_FRAGMENTS
 	/*look in stbl or traf for sample sampleGroupsDescription*/
 	if (!sgdesc && traf) {
@@ -8332,7 +8332,7 @@ GF_Err gf_isom_update_sample_description_from_template(GF_ISOFile *file, u32 tra
 			gf_isom_box_del(abox);
 			continue;
 		}
-		
+
 		if (!ent->child_boxes) ent->child_boxes = gf_list_new();
 		for (j=0; j<gf_list_count(ent->child_boxes); j++) {
 			GF_Box *b = gf_list_get(ent->child_boxes, j);
@@ -9167,4 +9167,3 @@ GF_Err gf_isom_set_sample_description_restricted(GF_ISOFile *movie, u32 trackNum
 
 
 #endif	/*!defined(GPAC_DISABLE_ISOM) && !defined(GPAC_DISABLE_ISOM_WRITE)*/
-

programming_language: C
CVE-2021-29469 (published 2021-04-23T18:15Z)

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/NodeRedis/node-redis
commit_details: repo_url: https://github.com/NodeRedis/node-redis
author: Leibale Eidelman
author_date: 2021-04-08 18:04:34-04:00
msg: fix #1569 - improve monitor_regex (#1595)

Co-authored-by: Guy Korland <gkorland@gmail.com>
repository: repo_url: https://github.com/NodeRedis/node-redis
repo_name: redis/node-redis
description: Redis Node.js client
repo_language: TypeScript
owner: NodeRedis
file_changes: filename: utils.js
change_type: ModificationType.MODIFY
diff: @@ -127,7 +127,7 @@ module.exports = {
     reply_to_object: replyToObject,
     print: print,
     err_code: /^([A-Z]+)\s+(.+)$/,
-    monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\]( ".+?")+$/,
+    monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\].*"$/,
     clone: convenienceClone,
     callback_or_emit: callbackOrEmit,
     reply_in_order: replyInOrder

programming_language: JavaScript
CVE-2016-8675 (published 2017-02-15T21:59Z)

The get_vlc2 function in get_bits.h in Libav before 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file, possibly related to startcode sequences during m4v detection.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/libav/libav
commit_details: repo_url: https://github.com/libav/libav
author: Michael Niedermayer
author_date: 2014-09-07 16:39:39+02:00
msg: m4vdec: Check for non-startcode 00 00 00 sequences in probe

This makes the m4v detection less trigger-happy.

Bug-Id: 949
Signed-off-by: Diego Biurrun <diego@biurrun.de>
repository: repo_url: https://github.com/libav/libav
repo_name: libav/libav
description: Libav github mirror, clone of git://git.libav.org/libav
repo_language: C
owner: libav
file_changes: filename: m4vdec.c
change_type: ModificationType.MODIFY
diff: @@ -33,16 +33,18 @@ static int mpeg4video_probe(AVProbeData *probe_packet)
 
     for (i = 0; i < probe_packet->buf_size; i++) {
         temp_buffer = (temp_buffer << 8) + probe_packet->buf[i];
-        if ((temp_buffer & 0xffffff00) != 0x100)
+        if (temp_buffer & 0xfffffe00)
+            continue;
+        if (temp_buffer < 2)
             continue;
 
         if (temp_buffer == VOP_START_CODE)
             VOP++;
         else if (temp_buffer == VISUAL_OBJECT_START_CODE)
             VISO++;
-        else if (temp_buffer < 0x120)
+        else if (temp_buffer >= 0x100 && temp_buffer < 0x120)
             VO++;
-        else if (temp_buffer < 0x130)
+        else if (temp_buffer >= 0x120 && temp_buffer < 0x130)
             VOL++;
         else if (!(0x1AF < temp_buffer && temp_buffer < 0x1B7) &&
                  !(0x1B9 < temp_buffer && temp_buffer < 0x1C4))

programming_language: C
CVE-2017-20170 (published 2023-01-17T14:15Z)

A vulnerability was found in ollpu parontalli. It has been classified as critical. Affected is an unknown function of the file httpdocs/index.php. The manipulation of the argument s leads to sql injection. The patch is identified as 6891bb2dec57dca6daabc15a6d2808c8896620e5. It is recommended to apply a patch to fix this issue. VDB-218418 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ollpu/parontalli
commit_details: repo_url: https://github.com/ollpu/parontalli
author: Roope Salmi
author_date: 2017-01-21 21:11:39+02:00
msg: Fix SQL-injection vulnerability in page identifier parameter

Well that's embarrassing...
repository: repo_url: https://github.com/ollpu/parontalli
repo_name: ollpu/parontalli
description: A horse stable website made from scratch.
repo_language: JavaScript
owner: ollpu
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -12,7 +12,10 @@ $fprow = mysqli_fetch_assoc($haku_fp);
 
 
 //Go to first page in order (front page) if ?s argument is not set
-if(!isset($_GET["s"]))	{$_GET['s'] = $fprow['uid'];}
+if(!isset($_GET["s"])) {$_GET['s'] = $fprow['uid'];}
+else {
+  $_GET['s'] = mysqli_real_escape_string($yht, $_GET['s']);
+}
 
 
 $haku_s = mysqli_query($yht, "SELECT * FROM `sivut` WHERE uid = '".$_GET['s']."' LIMIT 1");

programming_language: PHP
CVE-2020-5221 (published 2020-01-22T19:15Z)

In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in compose_abspath(). This has been fixed in version 2.11

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/troglobit/uftpd
commit_details: repo_url: https://github.com/troglobit/uftpd
author: Joachim Nilsson
author_date: 2019-08-31 10:08:29+02:00
msg: FTP/TFTP: Fix directory traversal regression, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
repository: repo_url: https://github.com/troglobit/uftpd
repo_name: troglobit/uftpd
description: FTP/TFTP server for Linux that just works™
repo_language: C
owner: troglobit
file_changes: filename: common.c
change_type: ModificationType.MODIFY
diff: @@ -92,7 +92,7 @@ check:
 		strlcat(rpath, name, sizeof(rpath));
 	}
 
-	if (!chrooted && strncmp(dir, home, strlen(home))) {
+	if (!chrooted && strncmp(rpath, home, strlen(home))) {
 		DBG("Failed non-chroot dir:%s vs home:%s", dir, home);
 		return NULL;
 	}

programming_language: C
CVE-2022-0905 (published 2022-03-10T15:15Z)

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/go-gitea/gitea
commit_details: repo_url: https://github.com/go-gitea/gitea
author: zeripath
author_date: 2022-03-10 02:00:05+00:00
msg: fix pam authorization (#19040)

https://huntr.dev/bounties/8d221f92-b2b1-4878-bc31-66ff272e5ceb/

Co-authored-by: ysf <34326+ysf@users.noreply.github.com>
repository: repo_url: https://github.com/go-gitea/gitea
repo_name: go-gitea/gitea
description: Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD
repo_language: Go
owner: go-gitea
file_changes: filename: pam.go
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,10 @@ func Auth(serviceName, userName, passwd string) (string, error) {
 	if err = t.Authenticate(0); err != nil {
 		return "", err
 	}
+	
+	if err = t.AcctMgmt(0); err != nil {
+	  return "", err
+  }
 
 	// PAM login names might suffer transformations in the PAM stack.
 	// We should take whatever the PAM stack returns for it.

programming_language: Go
CVE-2017-14639 (published 2017-09-21T17:29Z)

AP4_VisualSampleEntry::ReadFields in Core/Ap4SampleEntry.cpp in Bento4 1.5.0-617 uses incorrect character data types, which causes a stack-based buffer underflow and out-of-bounds write, leading to denial of service (application crash) or possibly unspecified other impact.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-843
cwe_name: Access of Resource Using Incompatible Type ('Type Confusion')
description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
extended_description: 
            When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access.
            While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways.
            This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.
         
         

Fix information:
repo_url: https://github.com/axiomatic-systems/Bento4
commit_details: repo_url: https://github.com/axiomatic-systems/Bento4
author: Gilles Boccon-Gibod
author_date: 2017-09-09 16:12:31-07:00
msg: fix for #190
repository: repo_url: https://github.com/axiomatic-systems/Bento4
repo_name: axiomatic-systems/Bento4
description: Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
repo_language: C++
owner: axiomatic-systems
file_changes: filename: Ap4SampleEntry.cpp
change_type: ModificationType.MODIFY
diff: @@ -772,13 +772,13 @@ AP4_VisualSampleEntry::ReadFields(AP4_ByteStream& stream)
     stream.ReadUI32(m_Reserved3);
     stream.ReadUI16(m_FrameCount);
 
-    char compressor_name[33];
+    AP4_UI08 compressor_name[33];
     compressor_name[32] = 0;
     stream.Read(compressor_name, 32);
-    int name_length = compressor_name[0];
+    AP4_UI08 name_length = compressor_name[0];
     if (name_length < 32) {
         compressor_name[name_length+1] = 0; // force null termination
-        m_CompressorName = &compressor_name[1];
+        m_CompressorName = (const char*)(&compressor_name[1]);
     }
 
     stream.ReadUI16(m_Depth);

programming_language: C++
CVE-2024-28179 (published 2024-03-20T20:15Z)

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can allow unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy. In many cases, this leads to remote unauthenticated arbitrary code execution, due to how affected instances use websockets. The websocket endpoints exposed by `jupyter_server` itself is not affected. Projects that do not rely on websockets are also not affected. Versions 3.2.3 and 4.1.1 contain a fix for this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jupyterhub/jupyter-server-proxy
commit_details: repo_url: https://github.com/jupyterhub/jupyter-server-proxy
author: Erik Sundell
author_date: 2024-03-13 09:34:28+01:00
msg: Merge pull request from GHSA-w3vc-fx9p-wp4v

Check authentication when websockets open
repository: repo_url: https://github.com/jupyterhub/jupyter-server-proxy
repo_name: jupyterhub/jupyter-server-proxy
description: Jupyter notebook server extension to proxy web services.
repo_language: Python
owner: jupyterhub
CVE-2022-31135 (published 2022-07-07T18:15Z)

Akashi is an open source server implementation of the Attorney Online video game based on the Ace Attorney universe. Affected versions of Akashi are subject to a denial of service attack. An attacker can use a specially crafted evidence packet to make an illegal modification, causing a server crash. This can be used to mount a denial-of-service exploit. Users are advised to upgrade. There is no known workaround for this issue.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-129
cwe_name: Improper Validation of Array Index
description: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/AttorneyOnline/akashi
commit_details: repo_url: https://github.com/AttorneyOnline/akashi
author: oldmud0
author_date: 2021-07-27 22:57:29-05:00
msg: Fix out of bounds crash on evidence
repository: repo_url: https://github.com/AttorneyOnline/akashi
repo_name: AttorneyOnline/akashi
description: C++ AO2 Server
repo_language: C++
owner: AttorneyOnline
file_changes: filename: packets.cpp
change_type: ModificationType.MODIFY
diff: @@ -378,7 +378,7 @@ void AOClient::pktRemoveEvidence(AreaData* area, int argc, QStringList argv, AOP
         return;
     bool is_int = false;
     int idx = argv[0].toInt(&is_int);
-    if (is_int && idx <= area->evidence().size() && idx >= 0) {
+    if (is_int && idx < area->evidence().size() && idx >= 0) {
         area->deleteEvidence(idx);
     }
     sendEvidenceList(area);
@@ -391,7 +391,7 @@ void AOClient::pktEditEvidence(AreaData* area, int argc, QStringList argv, AOPac
     bool is_int = false;
     int idx = argv[0].toInt(&is_int);
     AreaData::Evidence evi = {argv[1], argv[2], argv[3]};
-    if (is_int && idx <= area->evidence().size() && idx >= 0) {
+    if (is_int && idx < area->evidence().size() && idx >= 0) {
         area->replaceEvidence(idx, evi);
     }
     sendEvidenceList(area);

programming_language: C++
CVE-2019-20786 (published 2020-04-19T20:15Z)

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/pion/dtls
commit_details: repo_url: https://github.com/pion/dtls
author: Sean DuBois
author_date: 2019-10-11 02:12:16-07:00
msg: Assert that ApplicationData has epoch != 0

Otherwise we may accept unencrypted/unauthenticated ApplicationData
from a remote
repository: repo_url: https://github.com/pion/dtls
repo_name: pion/dtls
description: DTLS 1.2 Server/Client implementation for Go
repo_language: Go
owner: pion
file_changes: filename: conn.go
change_type: ModificationType.MODIFY
diff: @@ -559,6 +559,10 @@ func (c *Conn) handleIncomingPacket(buf []byte) (*alert, error) {
 		c.log.Trace("<- ChangeCipherSpec")
 		c.setRemoteEpoch(c.getRemoteEpoch() + 1)
 	case *applicationData:
+		if h.epoch == 0 {
+			return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("ApplicationData with epoch of 0")
+		}
+
 		c.decrypted <- content.data
 	default:
 		return &alert{alertLevelFatal, alertUnexpectedMessage}, fmt.Errorf("unhandled contentType %d", content.contentType())

programming_language: Go
CVE-2016-5706 (published 2016-07-03T01:59Z)

js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Michal Čihař
author_date: 2016-06-15 18:04:43+02:00
msg: Limit number of included scripts in get_scripts.js.php

This avoids potential DOS, the limit is same as we use for generating
the URLs.

Signed-off-by: Michal Čihař <michal@cihar.com>
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: get_scripts.js.php
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,8 @@ function () {
 
 $_GET['scripts'] = json_decode($_GET['scripts']);
 if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
-    foreach ($_GET['scripts'] as $script) {
+    // Only up to 10 scripts as this is what we generate
+    foreach (array_slice($_GET['scripts'], 0, 10) as $script) {
         // Sanitise filename
         $script_name = 'js';
 

programming_language: PHP