Jafar Akhondali JafarAkhondali

## webui-aria2 CVE-2023-39141
CVE-2023-39141 is reserved for this vulnerability

Project link:
https://github.com/ziahamza/webui-aria2/


Vulnerability type:
Path traversal

Root cause: This line https://github.com/ziahamza/webui-aria2/blob/109903f0e2774cf948698cd95a01f77f33d7dd2c/node-server.js#L10 accepts file name from URL input, without sanitizing it to be in the same directory.

## getunicodes.py
"""
Finds all unicode characters that produce at least one character in ASCII range when converted to Uppercase or Lowercase.

Result:
Char ß with code(223)	 to uppercase contains ASCII char(S). Full uppercase: SS
Char ß with code(223)	 to uppercase contains ASCII char(S). Full uppercase: SS
Char İ with code(304)	 to lowercase contains ASCII char(i). Full lowercase: i̇
Char ı with code(305)	 to uppercase contains ASCII char(I). Full uppercase: I
Char ŉ with code(329)	 to uppercase contains ASCII char(N). Full uppercase: ʼN
Char ſ with code(383)	 to uppercase contains ASCII char(S). Full uppercase: S

## rsa.py
#!/usr/bin/python3
"""
Sample code snippet to work with RSA encryption ( Don't use it in production :| )
"""

import libnum


def generate_keys(p, q, e):
    n = p * q

## glassstyle.min.css
#glass{position:absolute;border-radius:50%;box-shadow:0 0 0 7px rgba(255,255,255,0.85),0 0 7px 7px rgba(0,0,0,0.25),inset 0 0 40px 2px rgba(0,0,0,0.25);display:none;background-repeat:no-repeat;background-color:rgba(0,0,0,.6)}

## lightzoom.min.js
$.fn.lightzoom=function(options){var settings=$.extend({zoomPower:3,glassSize:175,},options);var halfSize=settings.glassSize/2;var quarterSize=settings.glassSize/4;var zoomPower=settings.zoomPower;$("body").append('<div id="glass"></div>');$("html > head").append($("<style> #glass{width: "+settings.glassSize+"px; height: "+settings.glassSize+"px;}</style>"));var faker;var obj=this;$("#glass").mousemove(function(event){var obj=this.targ;event.target=obj;faker(event,obj);});this.mousemove(function(event){faker(event,this);});faker=function(event,obj){document.getElementById("glass").targ=obj;var mx=event.pageX;var my=event.pageY;var w=obj.offsetWidth;var h=obj.offsetHeight;var ol=obj.offsetLeft;var ot=obj.offsetTop;if(mx>ol&&mx<ol+w&&ot<my&&ot+h>my){offsetXfixer=((mx-ol-w/2)/(w/2))*quarterSize;offsetYfixer=((my-ot-h/2)/(h/2))*quarterSize;var cx=(((mx-ol+offsetXfixer)/w))*100;var cy=(((my-ot+offsetYfixer)/h))*100;my-=halfSize;mx-=halfSize;$("#glass").css({top:(my),left:(mx),"background-image":" url('"+obj.src+"'
	CVE-2023-39141 is reserved for this vulnerability

	Project link:
	https://github.com/ziahamza/webui-aria2/


	Vulnerability type:
	Path traversal

	Root cause: This line https://github.com/ziahamza/webui-aria2/blob/109903f0e2774cf948698cd95a01f77f33d7dd2c/node-server.js#L10 accepts file name from URL input, without sanitizing it to be in the same directory.
	"""
	Finds all unicode characters that produce at least one character in ASCII range when converted to Uppercase or Lowercase.

	Result:
	Char ß with code(223) to uppercase contains ASCII char(S). Full uppercase: SS
	Char ß with code(223) to uppercase contains ASCII char(S). Full uppercase: SS
	Char İ with code(304) to lowercase contains ASCII char(i). Full lowercase: i̇
	Char ı with code(305) to uppercase contains ASCII char(I). Full uppercase: I
	Char ŉ with code(329) to uppercase contains ASCII char(N). Full uppercase: ʼN
	Char ſ with code(383) to uppercase contains ASCII char(S). Full uppercase: S
	#!/usr/bin/python3
	"""
	Sample code snippet to work with RSA encryption ( Don't use it in production :\| )
	"""

	import libnum


	def generate_keys(p, q, e):
	n = p * q