starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-3969 (published 2022-11-13T08:15Z)

A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-377
cwe_name: Insecure Temporary File
description: Creating and using insecure temporary files can leave application and system data vulnerable to attack.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/openkm/document-management-system
commit_details: repo_url: https://github.com/openkm/document-management-system
author: Paco Avila
author_date: 2022-09-05 10:18:54+02:00
msg: Fix Temporary Directory Hijacking or Information Disclosure Vulnerability

fix #332
repository: repo_url: https://github.com/openkm/document-management-system
repo_name: openkm/document-management-system
description: OpenKM is a Open Source Document Management System
repo_language: Java
owner: openkm
file_changes: filename: FileUtils.java
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,7 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.io.*;
+import java.nio.file.Files;
 import java.text.SimpleDateFormat;
 import java.util.Collection;
 import java.util.Date;
@@ -66,13 +67,7 @@ public class FileUtils {
 	 * @throws IOException If something fails.
 	 */
 	public static File createTempDir() throws IOException {
-		File tmpFile = File.createTempFile("okm", null);
-
-		if (!tmpFile.delete())
-			throw new IOException();
-		if (!tmpFile.mkdir())
-			throw new IOException();
-		return tmpFile;
+		return Files.createTempDirectory("okm").toFile();
 	}
 
 	/**
@@ -229,7 +224,7 @@ public class FileUtils {
 	}
 
 	/**
-	 * Create "year / month / day" directory structure. 
+	 * Create "year / month / day" directory structure.
 	 */
 	public static File createDateDir(String parent) {
 		SimpleDateFormat sdf = new SimpleDateFormat("yyyy" + File.separator + "MM" + File.separator + "dd");

programming_language: Java
CVE-2022-27243 (published 2022-03-18T18:15Z)

An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: Luciano Righetti
author_date: 2022-03-17 15:36:15+01:00
msg: fix: [security] lfi via custom terms file setting, as reported by Ianis BERNARD - NATO Cyber Security Centre
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: terms.ctp
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,8 @@
     if (!Configure::read('MISP.terms_file')) {
         $termsFile = APP ."View/Users/terms";
     } else {
-        $termsFile = APP . 'files' . DS . 'terms' . DS . Configure::read('MISP.terms_file');
+        $customTermsFile = basename(realpath(Configure::read('MISP.terms_file')));
+        $termsFile = APP . 'files' . DS . 'terms' . DS . $customTermsFile;
     }
     if (!(file_exists($termsFile))) {
         echo "<p>" . __("Terms and Conditions file not found.") . "</p>";

programming_language: PHP
CVE-2023-45827 (published 2023-11-06T18:15Z)

Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.\n

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/clickbar/dot-diver
commit_details: repo_url: https://github.com/clickbar/dot-diver
author: Daniel Thoma
author_date: 2023-11-02 23:41:08+01:00
msg: Merge pull request #12 from clickbar/fix/prototype-pollution

Add guards against prototype pollution
repository: repo_url: https://github.com/clickbar/dot-diver
repo_name: clickbar/dot-diver
description: A lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation.
repo_language: TypeScript
owner: clickbar
CVE-2019-17383 (published 2019-10-09T16:15Z)

The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/dspinhirne/netaddr-rb
commit_details: repo_url: https://github.com/dspinhirne/netaddr-rb
author: Dustin Spinhirne
author_date: 2019-10-03 08:55:42-05:00
msg: Merge pull request #20 from infakt-HNP/master

FIX for file permissions - using too high causes that gem install set 777 on files installed in system
repository: repo_url: https://github.com/dspinhirne/netaddr-rb
repo_name: dspinhirne/netaddr-rb
description: A Ruby library for performing calculations on IPv4 and IPv6 subnets.
repo_language: Ruby
owner: dspinhirne
CVE-2022-4687 (published 2022-12-23T12:15Z)

Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.

CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/usememos/memos
commit_details: repo_url: https://github.com/usememos/memos
author: boojack
author_date: 2022-12-23 18:38:24+08:00
msg: fix: disable decode patch id (#831)
repository: repo_url: https://github.com/usememos/memos
repo_name: usememos/memos
description: An open source, lightweight note-taking service. Easily capture and share your great thoughts.
repo_language: Go
owner: usememos
file_changes: filename: memo.go
change_type: ModificationType.MODIFY
diff: @@ -57,7 +57,7 @@ type MemoCreate struct {
 }
 
 type MemoPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	CreatedTs *int64 `json:"createdTs"`

programming_language: Go
filename: resource.go
change_type: ModificationType.MODIFY
diff: @@ -41,7 +41,7 @@ type ResourceFind struct {
 }
 
 type ResourcePatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64

programming_language: Go
filename: shortcut.go
change_type: ModificationType.MODIFY
diff: @@ -24,7 +24,7 @@ type ShortcutCreate struct {
 }
 
 type ShortcutPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64

programming_language: Go
filename: user.go
change_type: ModificationType.MODIFY
diff: @@ -69,7 +69,7 @@ func (create UserCreate) Validate() error {
 }
 
 type UserPatch struct {
-	ID int
+	ID int `json:"-"`
 
 	// Standard fields
 	UpdatedTs *int64

programming_language: Go
CVE-2017-14638 (published 2017-09-21T17:29Z)

AP4_AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp in Bento4 version 1.5.0-617 has missing NULL checks, leading to a NULL pointer dereference, segmentation fault, and application crash in AP4_Atom::SetType in Core/Ap4Atom.h.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/axiomatic-systems/Bento4
commit_details: repo_url: https://github.com/axiomatic-systems/Bento4
author: Gilles Boccon-Gibod
author_date: 2017-09-09 10:36:28-07:00
msg: fix for #182
repository: repo_url: https://github.com/axiomatic-systems/Bento4
repo_name: axiomatic-systems/Bento4
description: Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
repo_language: C++
owner: axiomatic-systems
file_changes: filename: Ap4AtomFactory.cpp
change_type: ModificationType.MODIFY
diff: @@ -490,13 +490,17 @@ AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream& stream,
           case AP4_ATOM_TYPE_HVCE:
             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;
             atom = AP4_HvccAtom::Create(size_32, stream);
-            atom->SetType(AP4_ATOM_TYPE_HVCE);
+            if (atom) {
+                atom->SetType(AP4_ATOM_TYPE_HVCE);
+            }
             break;
 
           case AP4_ATOM_TYPE_AVCE:
             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;
             atom = AP4_AvccAtom::Create(size_32, stream);
-            atom->SetType(AP4_ATOM_TYPE_AVCE);
+            if (atom) {
+                atom->SetType(AP4_ATOM_TYPE_AVCE);
+            }
             break;
 
     #if !defined(AP4_CONFIG_MINI_BUILD)

programming_language: C++
CVE-2019-17367 (published 2019-10-18T17:15Z)

OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/openwrt/luci
commit_details: repo_url: https://github.com/openwrt/luci
author: Jo-Philipp Wich
author_date: 2019-10-09 09:55:44+02:00
msg: luci-base: fix CSRF prevention for arcombine targets

The dispatcher failed to propagate the child target post security
requirements to the arcombine() dispatch target so far - fix this
by recursively testing the post security requirements.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
repository: repo_url: https://github.com/openwrt/luci
repo_name: openwrt/luci
description: LuCI - OpenWrt Configuration Interface
repo_language: JavaScript
owner: openwrt
file_changes: filename: dispatcher.lua
change_type: ModificationType.MODIFY
diff: @@ -149,7 +149,11 @@ function httpdispatch(request, prefix)
 	--context._disable_memtrace()
 end
 
-local function require_post_security(target)
+local function require_post_security(target, args)
+	if type(target) == "table" and target.type == "arcombine" and type(target.targets) == "table" then
+		return require_post_security((type(args) == "table" and #args > 0) and target.targets[2] or target.targets[1], args)
+	end
+
 	if type(target) == "table" then
 		if type(target.post) == "table" then
 			local param_name, required_val, request_val
@@ -470,7 +474,7 @@ function dispatch(request)
 		return
 	end
 
-	if c and require_post_security(c.target) then
+	if c and require_post_security(c.target, args) then
 		if not test_post_security(c) then
 			return
 		end

programming_language: Lua
CVE-2014-8399 (published 2014-10-31T14:55Z)

The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/desrt/systemd-shim
commit_details: repo_url: https://github.com/desrt/systemd-shim
author: Ryan Lortie
author_date: 2014-10-21 17:28:21-04:00
msg: security policy: remove clause for Abandon call

I committed this after copying it out of a work-in-progress branch that
was being worked on by Serge.  I didn't realise that it was most likely
only ever intended to be for debugging purposes.

According to Martin and Stéphane this is not needed and is a potential
security problem.  Let's close that hole.
repository: repo_url: https://github.com/desrt/systemd-shim
repo_name: desrt/systemd-shim
repo_language: C
owner: desrt
file_changes: filename: org.freedesktop.systemd1.conf
change_type: ModificationType.MODIFY
diff: @@ -86,10 +86,6 @@
                        send_interface="org.freedesktop.systemd1.Manager"
                        send_member="Dump"/>
 
-                <allow send_destination="org.freedesktop.systemd1"
-                       send_interface="org.freedesktop.systemd1.Scope"
-                       send_member="Abandon"/>
-
                 <allow receive_sender="org.freedesktop.systemd1"/>
         </policy>
 

programming_language: Shell
CVE-2023-27598 (published 2023-03-15T21:15Z)

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header to OpenSIPS triggers a segmentation fault when the function `calc_tag_suffix` is called. A specially crafted `Via` header, which is deemed correct by the parser, will pass uninitialized strings to the function `MD5StringArray` which leads to the crash. Abuse of this vulnerability leads to Denial of Service due to a crash. Since the uninitialized string points to memory location `0x0`, no further exploitation appears to be possible. No special network privileges are required to perform this attack, as long as the OpenSIPS configuration makes use of functions such as `sl_send_reply` or `sl_gen_totag` that trigger the vulnerable code. This issue has been fixed in versions 3.1.7 and 3.2.4.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/OpenSIPS/opensips
commit_details: repo_url: https://github.com/OpenSIPS/opensips
author: Bogdan-Andrei Iancu
author_date: 2021-11-12 16:01:47+02:00
msg: [core] fix parse_via() parsing

Issue discovered during OpenSIPS Security Audit 2021,
	by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-wxfg-3gwh-rhvx
repository: repo_url: https://github.com/OpenSIPS/opensips
repo_name: OpenSIPS/opensips
description: OpenSIPS is a GPL implementation of a multi-functionality SIP Server that targets to deliver a high-level technical solution (performance, security and quality) to be used in professional SIP server platforms.
repo_language: C
owner: OpenSIPS
file_changes: filename: parse_via.c
change_type: ModificationType.MODIFY
diff: @@ -1804,7 +1804,6 @@ parse_again:
 
 			case ':':
 				switch(state){
-					case F_HOST:
 					case F_IP6HOST:
 						state=P_IP6HOST;
 						break;

programming_language: C
CVE-2016-7145 (published 2017-03-07T15:59Z)

The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/evilnet/nefarious2
commit_details: repo_url: https://github.com/evilnet/nefarious2
author: Matthew Beeching
author_date: 2016-09-03 23:34:04+01:00
msg: Fix to prevent SASL security vulnerability
repository: repo_url: https://github.com/evilnet/nefarious2
repo_name: evilnet/nefarious2
description: Nefarious IRCu (Based on IRCu 2.10.12)
repo_language: C
owner: evilnet
file_changes: filename: m_authenticate.c
change_type: ModificationType.MODIFY
diff: @@ -150,6 +150,8 @@ int m_authenticate(struct Client* cptr, struct Client* sptr, int parc, char* par
 
   if (acptr) {
     if (first) {
+      if (*parv[1] == ':' || strchr(parv[1], ' '))
+		return exit_client(cptr, sptr, sptr, "Malformed AUTHENTICATE");
       if (!EmptyString(cli_sslclifp(cptr)))
         sendcmdto_one(&me, CMD_SASL, acptr, "%C %C!%u.%u S %s :%s", acptr, &me,
                       cli_fd(cptr), cli_saslcookie(cptr),
@@ -167,6 +169,8 @@ int m_authenticate(struct Client* cptr, struct Client* sptr, int parc, char* par
     }
   } else {
     if (first) {
+      if (*parv[1] == ':' || strchr(parv[1], ' '))
+        return exit_client(cptr, sptr, sptr, "Malformed AUTHENTICATE");
       if (!EmptyString(cli_sslclifp(cptr)))
         sendcmdto_serv_butone(&me, CMD_SASL, cptr, "* %C!%u.%u S %s :%s", &me,
                               cli_fd(cptr), cli_saslcookie(cptr),

programming_language: C
CVE-2024-1118 (published 2024-02-07T11:15Z)

The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/podlove/podlove-subscribe-button-wp-plugin
commit_details: repo_url: https://github.com/podlove/podlove-subscribe-button-wp-plugin
author: Eric Teubert
author_date: 2024-02-06 09:30:25+01:00
msg: fix: missing escaping in sql query
repository: repo_url: https://github.com/podlove/podlove-subscribe-button-wp-plugin
repo_name: podlove/podlove-subscribe-button-wp-plugin
description: WordPress plugin integrating the Podlove Subscribe Button
repo_language: PHP
owner: podlove
file_changes: filename: base.php
change_type: ModificationType.MODIFY
diff: @@ -210,9 +210,8 @@ abstract class Base {
 		$model = new $class();
 		$model->flag_as_not_new();
 		
-		$row = $wpdb->get_row(
-			'SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'' . $value . '\' LIMIT 0,1'
-		);
+		$query = $wpdb->prepare('SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'%s\' LIMIT 0,1', $value);
+		$row = $wpdb->get_row($query);
 		
 		if ( ! $row ) {
 			return null;

programming_language: PHP
CVE-2023-42822 (published 2023-09-27T18:15Z)

 xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/neutrinolabs/xrdp
commit_details: repo_url: https://github.com/neutrinolabs/xrdp
author: metalefty
author_date: 2023-09-27 17:37:24+09:00
msg: Merge pull request from GHSA-2hjx-rm4f-r9hw

CVE-2023-42822
repository: repo_url: https://github.com/neutrinolabs/xrdp
repo_name: neutrinolabs/xrdp
description: xrdp: an open source RDP server
repo_language: C
owner: neutrinolabs