starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2015-3880 (published 2017-09-19T15:29Z)

Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/phpbb/phpbb
commit_details: repo_url: https://github.com/phpbb/phpbb
author: Andreas Fischer
author_date: 2015-04-28 21:54:50+02:00
msg: Merge remote-tracking branch 'phpbb-security/ticket/security-180' into prep-release-3.0.14

* phpbb-security/ticket/security-180:
  [ticket/security-180] Add tests for redirecting to main URL
  [ticket/security-180] Always fail when redirecting to an insecure URL
  [ticket/security-180] Make sure that redirect goes to full URL plus slash
  [ticket/security-180] Check if redirect URL contains board URL
repository: repo_url: https://github.com/phpbb/phpbb
repo_name: phpbb/phpbb
description:  phpBB Development: phpBB is a popular open-source bulletin board written in PHP. This repository also contains the history of version 2.
repo_language: PHP
owner: phpbb
CVE-2023-48014 (published 2023-11-15T19:15Z)

GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/av_parsers.c.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-10-12 16:46:20+02:00
msg: Fixed #2613
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: av_parsers.c
change_type: ModificationType.MODIFY
diff: @@ -7726,13 +7726,19 @@ static Bool hevc_parse_vps_extension(HEVC_VPS *vps, GF_BitStream *bs)
 		}
 
 		if (splitting_flag) {
-			for (i = 0; i < num_scalability_types; i++) {
+			u32 num_bits=0;
+			for (i = 0; i < num_scalability_types-1; i++) {
 				dim_bit_offset[i] = 0;
+				num_bits+=dimension_id_len[i];
 				for (j = 0; j < i; j++)
 					dim_bit_offset[i] += dimension_id_len[j];
 			}
-			dimension_id_len[num_scalability_types - 1] = 1 + (5 - dim_bit_offset[num_scalability_types - 1]);
-			dim_bit_offset[num_scalability_types] = 6;
+			if (num_bits>=6) {
+				GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] Too many its defined for dimension IDs (%d vs 5 max)\n", num_bits));
+				return -1;
+			}
+			dimension_id_len[num_scalability_types - 1] = 6 - num_bits; //1 + (5 - dim_bit_offset[num_scalability_types - 1]);
+			dim_bit_offset[num_scalability_types - 1] = 6;
 		}
 	}
 

programming_language: C
CVE-2020-36766 (published 2023-09-18T09:15Z)

An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct.

CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Hans Verkuil
author_date: 2020-06-26 12:44:26+02:00
msg: cec-api: prevent leaking memory through hole in structure

Fix this smatch warning:

drivers/media/cec/core/cec-api.c:156 cec_adap_g_log_addrs() warn: check that 'log_addrs' doesn't leak information (struct has a hole after
'features')

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: cec-api.c
change_type: ModificationType.MODIFY
diff: @@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap,
 	struct cec_log_addrs log_addrs;
 
 	mutex_lock(&adap->lock);
-	log_addrs = adap->log_addrs;
+	/*
+	 * We use memcpy here instead of assignment since there is a
+	 * hole at the end of struct cec_log_addrs that an assignment
+	 * might ignore. So when we do copy_to_user() we could leak
+	 * one byte of memory.
+	 */
+	memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs));
 	if (!adap->is_configured)
 		memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID,
 		       sizeof(log_addrs.log_addr));

programming_language: C
CVE-2017-12168 (published 2017-09-20T08:29Z)

The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause a denial of service (assertion failure and host OS crash) by accessing the Performance Monitors Cycle Count Register (PMCCNTR).

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 6.0, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Wei Huang
author_date: 2016-11-16 09:20:57+00:00
msg: arm64: KVM: pmu: Fix AArch32 cycle counter access

We're missing the handling code for the cycle counter accessed
from a 32bit guest, leading to unexpected results.

Cc: stable@vger.kernel.org # 4.6+
Signed-off-by: Wei Huang <wei@redhat.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: sys_regs.c
change_type: ModificationType.MODIFY
diff: @@ -597,8 +597,14 @@ static bool access_pmu_evcntr(struct kvm_vcpu *vcpu,
 
 			idx = ARMV8_PMU_CYCLE_IDX;
 		} else {
-			BUG();
+			return false;
 		}
+	} else if (r->CRn == 0 && r->CRm == 9) {
+		/* PMCCNTR */
+		if (pmu_access_event_counter_el0_disabled(vcpu))
+			return false;
+
+		idx = ARMV8_PMU_CYCLE_IDX;
 	} else if (r->CRn == 14 && (r->CRm & 12) == 8) {
 		/* PMEVCNTRn_EL0 */
 		if (pmu_access_event_counter_el0_disabled(vcpu))
@@ -606,7 +612,7 @@ static bool access_pmu_evcntr(struct kvm_vcpu *vcpu,
 
 		idx = ((r->CRm & 3) << 3) | (r->Op2 & 7);
 	} else {
-		BUG();
+		return false;
 	}
 
 	if (!pmu_counter_idx_valid(vcpu, idx))

programming_language: C
CVE-2021-21308 (published 2021-02-26T20:15Z)

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/PrestaShop/PrestaShop
commit_details: repo_url: https://github.com/PrestaShop/PrestaShop
author: GoT
author_date: 2021-02-22 10:20:32+01:00
msg: Merge pull request from GHSA-557h-hf3c-whcg

Make sure session is cleared using soft logout
repository: repo_url: https://github.com/PrestaShop/PrestaShop
repo_name: PrestaShop/PrestaShop
description: PrestaShop is the universal open-source software platform to build your e-commerce solution.
repo_language: PHP
owner: PrestaShop
CVE-2021-40839 (published 2021-09-10T02:15Z)

The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\\x2f\\x7f), enabling a remote attack that consumes CPU and memory.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/aresch/rencode
commit_details: repo_url: https://github.com/aresch/rencode
author: Andrew Resch
author_date: 2021-08-09 20:44:51-07:00
msg: Fix checking if typecode is valid while decoding.

This bug will cause rencode to hang if the invalid typecode is included
in a sequence type (list, dict) since the position will not change and
the loop checking for the termination byte never returns.

This change is a copy of PR #29 with a few aesthetic changes.
repository: repo_url: https://github.com/aresch/rencode
repo_name: aresch/rencode
description: Python module for fast (basic) object serialization similar to bencode
repo_language: Python
owner: aresch
file_changes: filename: _rencode.pyx
change_type: ModificationType.MODIFY
diff: @@ -527,6 +527,8 @@ cdef decode(char *data, unsigned int *pos):
         return decode_fixed_dict(data, pos)
     elif typecode == CHR_DICT:
         return decode_dict(data, pos)
+    else:
+        raise ValueError("Invalid typecode: %d at pos: %d" % (typecode, pos[0]))
 
 def loads(data, decode_utf8=False):
     """

programming_language: Python
filename: test_rencode.py
change_type: ModificationType.MODIFY
diff: @@ -401,6 +401,11 @@ class TestRencode(unittest.TestCase):
             "version number does not match",
         )
 
+    def test_invalid_typecode(self):
+        s = b";\x2f\x7f"
+        with self.assertRaises(ValueError):
+            rencode.loads(s)
+
 
 if __name__ == "__main__":
     unittest.main()

programming_language: Python
CVE-2022-25375 (published 2022-02-20T20:15Z)

An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-1284
cwe_name: Improper Validation of Specified Quantity in Input
description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
extended_description: 
				Specified quantities include size, length, frequency, price, rate, number of operations, time, and others. Code may rely on specified quantities to allocate resources, perform calculations, control iteration, etc. When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
			
			

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Greg Kroah-Hartman
author_date: 2022-02-09 16:37:53+01:00
msg: usb: gadget: rndis: check size of RNDIS_MSG_SET command

Check the size of the RNDIS_MSG_SET command given to us before
attempting to respond to an invalid message size.

Reported-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Cc: stable@kernel.org
Tested-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: rndis.c
change_type: ModificationType.MODIFY
diff: @@ -637,14 +637,17 @@ static int rndis_set_response(struct rndis_params *params,
 	rndis_set_cmplt_type *resp;
 	rndis_resp_t *r;
 
+	BufLength = le32_to_cpu(buf->InformationBufferLength);
+	BufOffset = le32_to_cpu(buf->InformationBufferOffset);
+	if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
+	    (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
+		    return -EINVAL;
+
 	r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
 	if (!r)
 		return -ENOMEM;
 	resp = (rndis_set_cmplt_type *)r->buf;
 
-	BufLength = le32_to_cpu(buf->InformationBufferLength);
-	BufOffset = le32_to_cpu(buf->InformationBufferOffset);
-
 #ifdef	VERBOSE_DEBUG
 	pr_debug("%s: Length: %d\n", __func__, BufLength);
 	pr_debug("%s: Offset: %d\n", __func__, BufOffset);

programming_language: C
CVE-2017-6800 (published 2017-03-10T10:59Z)

An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/Yeraze/ytnef
commit_details: repo_url: https://github.com/Yeraze/ytnef
author: Randall Hand
author_date: 2017-02-23 14:26:49-05:00
msg: BugFix - data length

Even tho this is a "LONG" type, it's actually only 4 bytes. Typecasting
it to a long* caused a dereference beyond the end of the allocated
region.

issues#28
repository: repo_url: https://github.com/Yeraze/ytnef
repo_name: Yeraze/ytnef
description: Yeraze's TNEF Stream Reader - for winmail.dat files
repo_language: Shell
owner: Yeraze
file_changes: filename: ytnef.c
change_type: ModificationType.MODIFY
diff: @@ -1390,7 +1390,7 @@ void MAPIPrint(MAPIProps *p) {
           printf("] (%llu)\n", ddword_tmp);
           break;
         case PT_LONG:
-          printf("    Value: %li\n", *((long*)mapidata->data));
+          printf("    Value: %i\n", *((int*)mapidata->data));
           break;
         case PT_I2:
           printf("    Value: %hi\n", *((short int*)mapidata->data));

programming_language: C++
CVE-2019-12108 (published 2019-05-15T23:29Z)

A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for int_port.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/miniupnp/miniupnp
commit_details: repo_url: https://github.com/miniupnp/miniupnp
author: Thomas Bernard
author_date: 2018-12-18 23:47:54+01:00
msg: fix error from commit 13585f15c7f7dc28bbbba1661efb280d530d114c
repository: repo_url: https://github.com/miniupnp/miniupnp
repo_name: miniupnp/miniupnp
description: UPnP IGD implementation
repo_language: C
owner: miniupnp
file_changes: filename: upnpsoap.c
change_type: ModificationType.MODIFY
diff: @@ -1850,7 +1850,7 @@ GetOutboundPinholeTimeout(struct upnphttp * h, const char * action, const char *
 	rem_port = GetValueFromNameValueList(&data, "RemotePort");
 	protocol = GetValueFromNameValueList(&data, "Protocol");
 
-	if (!int_port || !ext_port || !protocol)
+	if (!int_port || !rem_port || !protocol)
 	{
 		ClearNameValueList(&data);
 		SoapError(h, 402, "Invalid Args");

programming_language: C
repo_url: https://github.com/miniupnp/miniupnp
commit_details: repo_url: https://github.com/miniupnp/miniupnp
author: Thomas Bernard
author_date: 2018-12-18 22:54:51+01:00
msg: GetOutboundPinholeTimeout: check args
repository: repo_url: https://github.com/miniupnp/miniupnp
repo_name: miniupnp/miniupnp
description: UPnP IGD implementation
repo_language: C
owner: miniupnp
file_changes: filename: upnpsoap.c
change_type: ModificationType.MODIFY
diff: @@ -1850,6 +1850,13 @@ GetOutboundPinholeTimeout(struct upnphttp * h, const char * action, const char *
 	rem_port = GetValueFromNameValueList(&data, "RemotePort");
 	protocol = GetValueFromNameValueList(&data, "Protocol");
 
+	if (!int_port || !ext_port || !protocol)
+	{
+		ClearNameValueList(&data);
+		SoapError(h, 402, "Invalid Args");
+		return;
+	}
+
 	rport = (unsigned short)atoi(rem_port);
 	iport = (unsigned short)atoi(int_port);
 	/*proto = atoi(protocol);*/

programming_language: C
CVE-2014-8322 (published 2020-01-31T22:15Z)

Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/aircrack-ng/aircrack-ng
commit_details: repo_url: https://github.com/aircrack-ng/aircrack-ng
author: Thomas d'Otreppe
author_date: 2014-10-03 01:53:50+00:00
msg: Aireplay-ng: Fixed tcp_test stack overflow (Closes #14 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2417 28c6078b-6c39-48e3-add9-af49d547ecab
repository: repo_url: https://github.com/aircrack-ng/aircrack-ng
repo_name: aircrack-ng/aircrack-ng
description: WiFi security auditing tools suite
repo_language: C
owner: aircrack-ng
file_changes: filename: aireplay-ng.c
change_type: ModificationType.MODIFY
diff: @@ -5398,6 +5398,8 @@ int tcp_test(const char* ip_str, const short port)
         if( (unsigned)caplen == sizeof(nh))
         {
             len = ntohl(nh.nh_len);
+            if (len > 1024 || len < 0)
+                continue;
             if( nh.nh_type == 1 && i==0 )
             {
                 i=1;

programming_language: C
CVE-2016-9288 (published 2016-11-11T23:59Z)

In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/exponentcms/exponent-cms
commit_details: repo_url: https://github.com/exponentcms/exponent-cms
author: dleffler
author_date: 2016-11-03 10:15:00-04:00
msg: fix security vulnerability to reranking pages; reported by kyohpc
repository: repo_url: https://github.com/exponentcms/exponent-cms
repo_name: exponentcms/exponent-cms
description: Content Management, Simple.
repo_language: PHP
owner: exponentcms
file_changes: filename: navigationController.php
change_type: ModificationType.MODIFY
diff: @@ -39,6 +39,8 @@ class navigationController extends expController {
         'move'      => 'Move Page',
         'remove'    => 'Remove Page',
         'reparent'    => 'Reparent Page',
+        'dragndroprerank'    => 'Rerank Page',
+        'dragndroprerank2'    => 'Rerank Page',
     );
     public $remove_configs = array(
         'aggregation',
@@ -858,8 +860,8 @@ class navigationController extends expController {
     public static function DragnDropReRank() {
         global $db, $router;
 
-        $move   = $router->params['move'];
-        $target = $router->params['target'];
+        $move   = intval($router->params['move']);
+        $target = intval($router->params['target']);
         $type   = $router->params['type'];
         $targSec = $db->selectObject("section","id=".$target);
 //        $targSec  = new section($target);

programming_language: PHP