rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.
Vulnerability ID: CVE-2022-21719
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/glpi-project/glpi
Published: 2022-01-28
File: ajax/common.tabs.php
Commit message: Merge pull request from GHSA-6cj4-g839-gj5j
Commit author: Alexandre Delaunay

Vulnerable version (before fix):
   if (isset($_GET['full_page_tab'])) {    echo "<div class='center' id='debugajax'>";    echo "<a href='".htmlentities($_SERVER['REQUEST_URI'])."' class='vsubmit'>Reload</a>";    echo "</div>";     // I think that we should display this warning, because tabs are not prepare    // for being used full space ...    if (!isset($_SESSION['glpi_warned_about_full_page_tab'])) {

Fixed version (after fix):
   if (isset($_GET['full_page_tab'])) {    // I think that we should display this warning, because tabs are not prepare    // for being used full space ...    if (!isset($_SESSION['glpi_warned_about_full_page_tab'])) {

Patch:
patch: @@ -107,10 +107,6 @@
 
 
 if (isset($_GET['full_page_tab'])) {
-   echo "<div class='center' id='debugajax'>";
-   echo "<a href='".htmlentities($_SERVER['REQUEST_URI'])."' class='vsubmit'>Reload</a>";
-   echo "</div>";
-
    // I think that we should display this warning, because tabs are not prepare
    // for being used full space ...
    if (!isset($_SESSION['glpi_warned_about_full_page_tab'])) {
path: ajax/common.tabs.php
Vulnerability: GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.
Vulnerability ID: CVE-2022-21720
CWE: CWE-89
Severity score: 2.9
Project: https://github.com/glpi-project/glpi
Published: 2022-01-28
File: front/entity.form.php
Commit message: Merge pull request from GHSA-5hg4-r64r-rf83
Commit author: Cédric Anne

Vulnerable version (before fix):
 }  if (array_key_exists('custom_css_code', $_POST)) {    $_POST['custom_css_code'] = $_UPOST['custom_css_code']; }  include (GLPI_ROOT . "/front/dropdown.common.form.php");

Fixed version (after fix):
 }  if (array_key_exists('custom_css_code', $_POST)) {    // Prevent sanitize process to alter '<', '>' and '&' chars.    $_POST['custom_css_code'] = $DB->escape($_UPOST['custom_css_code']); }  include (GLPI_ROOT . "/front/dropdown.common.form.php");

Patch:
patch: @@ -41,7 +41,8 @@
 }
 
 if (array_key_exists('custom_css_code', $_POST)) {
-   $_POST['custom_css_code'] = $_UPOST['custom_css_code'];
+   // Prevent sanitize process to alter '<', '>' and '&' chars.
+   $_POST['custom_css_code'] = $DB->escape($_UPOST['custom_css_code']);
 }
 
 include (GLPI_ROOT . "/front/dropdown.common.form.php");
path: front/entity.form.php
Vulnerability: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
Vulnerability ID: CVE-2022-21723
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/pjsip/pjproject
Published: 2022-01-27
File: pjlib-util/src/pjlib-util/scanner.c
Commit message: Merge pull request from GHSA-7fw8-54cv-r7pm
Commit author: sauwming

Vulnerable version (before fix):
 PJ_DEF(void) pj_scan_get_n( pj_scanner *scanner,  PJ_DEF(int) pj_scan_get_char( pj_scanner *scanner ) {     int chr = *scanner->curptr;      if (!chr) { 	pj_scan_syntax_err(scanner); 	return 0;     }      ++scanner->curptr;      if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws) { 	pj_scan_skip_whitespace(scanner);     }     return chr;

Fixed version (after fix):
 PJ_DEF(void) pj_scan_get_n( pj_scanner *scanner,  PJ_DEF(int) pj_scan_get_char( pj_scanner *scanner ) {     register char *s = scanner->curptr;     int chr;      if (s >= scanner->end || !*s) { 	pj_scan_syntax_err(scanner); 	return 0;     }      chr = *s;      ++s;     scanner->curptr = s;     if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&     	scanner->skip_ws)     { 	pj_scan_skip_whitespace(scanner);     }     return chr;

Patch:
patch: @@ -444,16 +444,21 @@ PJ_DEF(void) pj_scan_get_n( pj_scanner *scanner,
 
 PJ_DEF(int) pj_scan_get_char( pj_scanner *scanner )
 {
-    int chr = *scanner->curptr;
+    register char *s = scanner->curptr;
+    int chr;
 
-    if (!chr) {
+    if (s >= scanner->end || !*s) {
 	pj_scan_syntax_err(scanner);
 	return 0;
     }
 
-    ++scanner->curptr;
+    chr = *s;
 
-    if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws) {
+    ++s;
+    scanner->curptr = s;
+    if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
+    	scanner->skip_ws)
+    {
 	pj_scan_skip_whitespace(scanner);
     }
     return chr;
path: pjlib-util/src/pjlib-util/scanner.c
Vulnerability: iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible.
Vulnerability ID: CVE-2022-23609
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/bildsben/iTunesRPC-Remastered
Published: 2022-02-04
File: upload/server.py
Commit message: quick security fix
Commit author: Ben

Vulnerable version (before fix):
 import random from html import escape from os import remove  import magic from flask import Flask, abort, request from PIL import Image def uploadimage():     ):  # if it is not over the limit, it will skip. if it is, it does this.         # if we have gone over our cache limit, let's delete the first entry.         filename = all_files[0][1] + all_files[0][2]         remove(filename)         del all_files[0]         length = len(all_files) 

Fixed version (after fix):
 import random from html import escape from os import remove import werkzeug.utils import magic from flask import Flask, abort, request from PIL import Image def uploadimage():     ):  # if it is not over the limit, it will skip. if it is, it does this.         # if we have gone over our cache limit, let's delete the first entry.         filename = all_files[0][1] + all_files[0][2]         remove(werkzeug.utils.secure_filename(filename))         del all_files[0]         length = len(all_files) 

Patch:
patch: @@ -5,7 +5,7 @@
 import random
 from html import escape
 from os import remove
-
+import werkzeug.utils
 import magic
 from flask import Flask, abort, request
 from PIL import Image
@@ -189,7 +189,7 @@ def uploadimage():
     ):  # if it is not over the limit, it will skip. if it is, it does this.
         # if we have gone over our cache limit, let's delete the first entry.
         filename = all_files[0][1] + all_files[0][2]
-        remove(filename)
+        remove(werkzeug.utils.secure_filename(filename))
         del all_files[0]
         length = len(all_files)
path: upload/server.py
Vulnerability: iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.
Vulnerability ID: CVE-2022-23611
CWE: CWE-78
Severity score: 6.4
Project: https://github.com/bildsben/iTunesRPC-Remastered
Published: 2022-02-04
File: module/connect_to_server.py
Commit message: small fix
Commit author: Ben

Vulnerable version (before fix):
 def get(image_file, domain, title, singer, album):     import json     import os     from html import unescape      import requests      api = f"http://{domain}:7873/bGVhdmVfcmlnaHRfbm93"      with open(image_file, "rb") as f:

Fixed version (after fix):
 def get(image_file, domain, title, singer, album):     import json     import os     from html import unescape     import werkzeug.utils     import requests      image_file = werkzeug.utils.secure_filename(ast.literal_eval(image_file))      api = f"http://{domain}:7873/bGVhdmVfcmlnaHRfbm93"      with open(image_file, "rb") as f:

Patch:
patch: @@ -24,9 +24,11 @@ def get(image_file, domain, title, singer, album):
     import json
     import os
     from html import unescape
-
+    import werkzeug.utils
     import requests
 
+    image_file = werkzeug.utils.secure_filename(ast.literal_eval(image_file))
+
     api = f"http://{domain}:7873/bGVhdmVfcmlnaHRfbm93"
 
     with open(image_file, "rb") as f:
path: module/connect_to_server.py
Vulnerability: m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
Vulnerability ID: CVE-2022-23626
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/m1k1o/blog
Published: 2022-02-08
File: app/image.class.php
Commit message: check image create errors.
Commit author: Miroslav Šedivý

Vulnerable version (before fix):
 private static function thumb($source_path, $thumb_path){ 		}  		$old_image = $imgcreatefrom($source_path); 		$new_image = imagecreatetruecolor($new_w, $new_h); 		imagecopyresampled($new_image, $old_image, 0, 0, 0, 0, $new_w, $new_h, $source_w, $source_h);  		$new_image = self::fix_orientation($source_path, $new_image); 		$old_image = self::fix_orientation($source_path, $old_image);  		$imgt($new_image, $thumb_path); 		$imgt($old_image, $source_path); 		return true; 	}  	public static function upload(){

Fixed version (after fix):
 private static function thumb($source_path, $thumb_path){ 		}  		$old_image = $imgcreatefrom($source_path); 		if ($old_image === false) return false;  		$new_image = imagecreatetruecolor($new_w, $new_h); 		imagecopyresampled($new_image, $old_image, 0, 0, 0, 0, $new_w, $new_h, $source_w, $source_h);  		$new_image = self::fix_orientation($source_path, $new_image); 		$old_image = self::fix_orientation($source_path, $old_image);  		return $imgt($new_image, $thumb_path) 			&& $imgt($old_image, $source_path); 	}  	public static function upload(){

Patch:
patch: @@ -110,15 +110,16 @@ private static function thumb($source_path, $thumb_path){
 		}
 
 		$old_image = $imgcreatefrom($source_path);
+		if ($old_image === false) return false;
+
 		$new_image = imagecreatetruecolor($new_w, $new_h);
 		imagecopyresampled($new_image, $old_image, 0, 0, 0, 0, $new_w, $new_h, $source_w, $source_h);
 
 		$new_image = self::fix_orientation($source_path, $new_image);
 		$old_image = self::fix_orientation($source_path, $old_image);
 
-		$imgt($new_image, $thumb_path);
-		$imgt($old_image, $source_path);
-		return true;
+		return $imgt($new_image, $thumb_path)
+			&& $imgt($old_image, $source_path);
 	}
 
 	public static function upload(){
path: app/image.class.php
Vulnerability: K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links.
Vulnerability ID: CVE-2022-23637
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/k-box/k-box
Published: 2022-02-14
File: config/markdown.php
Commit message: Update markdown configuration
Commit author: Alessio

Vulnerable version (before fix):
     |     */      'allow_unsafe_links' => true,      /*      * Configuration related to ExternalLinkExtension

Fixed version (after fix):
     |     */      'allow_unsafe_links' => false,      /*      * Configuration related to ExternalLinkExtension

Patch:
patch: @@ -144,7 +144,7 @@
     |
     */
 
-    'allow_unsafe_links' => true,
+    'allow_unsafe_links' => false,
 
     /*
      * Configuration related to ExternalLinkExtension
path: config/markdown.php
Vulnerability: Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3.
Vulnerability ID: CVE-2022-2365
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/zadam/trilium
Published: 2022-07-10
File: src/public/app/widgets/dialogs/export.js
Commit message: fix note title escaping in export dialog
Commit author: zadam

Vulnerable version (before fix):
 export default class ExportDialog extends BasicWidget {         const {noteId, parentNoteId} = treeService.getNoteIdAndParentIdFromNotePath(notePath);          this.branchId = await froca.getBranchId(parentNoteId, noteId);          const noteTitle = await treeService.getNoteTitle(noteId);          this.$noteTitle.html(noteTitle);     }      exportBranch(branchId, type, format, version) {

Fixed version (after fix):
 export default class ExportDialog extends BasicWidget {         const {noteId, parentNoteId} = treeService.getNoteIdAndParentIdFromNotePath(notePath);          this.branchId = await froca.getBranchId(parentNoteId, noteId);         this.$noteTitle.text(await treeService.getNoteTitle(noteId));     }      exportBranch(branchId, type, format, version) {

Patch:
patch: @@ -213,10 +213,7 @@ export default class ExportDialog extends BasicWidget {
         const {noteId, parentNoteId} = treeService.getNoteIdAndParentIdFromNotePath(notePath);
 
         this.branchId = await froca.getBranchId(parentNoteId, noteId);
-
-        const noteTitle = await treeService.getNoteTitle(noteId);
-
-        this.$noteTitle.html(noteTitle);
+        this.$noteTitle.text(await treeService.getNoteTitle(noteId));
     }
 
     exportBranch(branchId, type, format, version) {
path: src/public/app/widgets/dialogs/export.js
Vulnerability: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
Vulnerability ID: CVE-2022-24716
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/Icinga/icingaweb2
Published: 2022-03-08
File: library/Icinga/Web/Controller/StaticController.php
Commit message: Merge pull request from GHSA-5p3f-rh28-8frw

v2.9 Backport
Commit author: Johannes Meyer

Vulnerable version (before fix):
 public function handle(Request $request)         }          $assetRoot = $library->getStaticAssetPath();         $filePath = $assetRoot . DIRECTORY_SEPARATOR . $assetPath;          // Doesn't use realpath as it isn't supposed to access files outside asset/static         if (! is_readable($filePath) || ! is_file($filePath)) {             $app->getResponse()                 ->setHttpResponseCode(404); 

Fixed version (after fix):
 public function handle(Request $request)         }          $assetRoot = $library->getStaticAssetPath();         if (empty($assetRoot)) {             $app->getResponse()                 ->setHttpResponseCode(404);              return;         }          $filePath = $assetRoot . DIRECTORY_SEPARATOR . $assetPath;         $dirPath = realpath(dirname($filePath)); // dirname, because the file may be a link          if (             $dirPath === false             || substr($dirPath, 0, strlen($assetRoot)) !== $assetRoot             || ! is_file($filePath)         ) {             $app->getResponse()                 ->setHttpResponseCode(404); 

Patch:
patch: @@ -39,10 +39,21 @@ public function handle(Request $request)
         }
 
         $assetRoot = $library->getStaticAssetPath();
+        if (empty($assetRoot)) {
+            $app->getResponse()
+                ->setHttpResponseCode(404);
+
+            return;
+        }
+
         $filePath = $assetRoot . DIRECTORY_SEPARATOR . $assetPath;
+        $dirPath = realpath(dirname($filePath)); // dirname, because the file may be a link
 
-        // Doesn't use realpath as it isn't supposed to access files outside asset/static
-        if (! is_readable($filePath) || ! is_file($filePath)) {
+        if (
+            $dirPath === false
+            || substr($dirPath, 0, strlen($assetRoot)) !== $assetRoot
+            || ! is_file($filePath)
+        ) {
             $app->getResponse()
                 ->setHttpResponseCode(404);
path: library/Icinga/Web/Controller/StaticController.php
Vulnerability: MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds.
Vulnerability ID: CVE-2022-24734
CWE: CWE-94
Severity score: 6.4
Project: https://github.com/mybb/mybb
Published: 2022-03-09
File: admin/modules/config/settings.php
Commit message: Fix ACP Settings management RCE
Commit author: Tomasz Mlynski

Vulnerable version (before fix):
 		}  		// do some type filtering 		$mybb->input['type'] = str_replace("\n", "", $mybb->input['type']); 		if(strtolower(substr($mybb->input['type'], 0, 3)) == "php") 		{ 			$mybb->input['type'] = ""; 		} 		}  		// do some type filtering 		$mybb->input['type'] = str_replace("\n", "", $mybb->input['type']); 		if(strtolower(substr($mybb->input['type'], 0, 3)) == "php") 		{ 			$mybb->input['type'] = ""; 		}

Fixed version (after fix):
 		}  		// do some type filtering 		$mybb->input['type'] = $mybb->get_input('type'); 		if(!ctype_alnum($mybb->input['type']) || strtolower($mybb->input['type']) == "php") 		{ 			$mybb->input['type'] = ""; 		} 		}  		// do some type filtering 		$mybb->input['type'] = $mybb->get_input('type'); 		if(!ctype_alnum($mybb->input['type']) || strtolower($mybb->input['type']) == "php") 		{ 			$mybb->input['type'] = ""; 		}

Patch:
patch: @@ -293,8 +293,8 @@
 		}
 
 		// do some type filtering
-		$mybb->input['type'] = str_replace("\n", "", $mybb->input['type']);
-		if(strtolower(substr($mybb->input['type'], 0, 3)) == "php")
+		$mybb->input['type'] = $mybb->get_input('type');
+		if(!ctype_alnum($mybb->input['type']) || strtolower($mybb->input['type']) == "php")
 		{
 			$mybb->input['type'] = "";
 		}
@@ -496,8 +496,8 @@
 		}
 
 		// do some type filtering
-		$mybb->input['type'] = str_replace("\n", "", $mybb->input['type']);
-		if(strtolower(substr($mybb->input['type'], 0, 3)) == "php")
+		$mybb->input['type'] = $mybb->get_input('type');
+		if(!ctype_alnum($mybb->input['type']) || strtolower($mybb->input['type']) == "php")
 		{
 			$mybb->input['type'] = "";
 		}
path: admin/modules/config/settings.php
Vulnerability: PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
Vulnerability ID: CVE-2022-24764
CWE: CWE-120
Severity score: 2.9
Project: https://github.com/pjsip/pjproject
Published: 2022-03-22
File: pjmedia/src/pjmedia/sdp.c
Commit message: Merge pull request from GHSA-f5qg-pqcg-765m
Commit author: Nanang Izzuddin

Vulnerable version (before fix):
 static int print_media_desc(const pjmedia_sdp_media *m, char *buf, pj_size_t len     pj_memcpy(p, m->desc.transport.ptr, m->desc.transport.slen);     p += m->desc.transport.slen;     for (i=0; i<m->desc.fmt_count; ++i) { 	*p++ = ' '; 	pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen); 	p += m->desc.fmt[i].slen;     }     *p++ = '\r';     *p++ = '\n';      /* print connection info, if present. */     if (m->conn) {

Fixed version (after fix):
 static int print_media_desc(const pjmedia_sdp_media *m, char *buf, pj_size_t len     pj_memcpy(p, m->desc.transport.ptr, m->desc.transport.slen);     p += m->desc.transport.slen;     for (i=0; i<m->desc.fmt_count; ++i) { 	if (end-p > m->desc.fmt[i].slen) { 	    *p++ = ' '; 	    pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen); 	    p += m->desc.fmt[i].slen; 	} else { 	    return -1; 	}     }      if (end-p >= 2) { 	*p++ = '\r'; 	*p++ = '\n';     } else { 	return -1;     }      /* print connection info, if present. */     if (m->conn) {

Patch:
patch: @@ -733,12 +733,21 @@ static int print_media_desc(const pjmedia_sdp_media *m, char *buf, pj_size_t len
     pj_memcpy(p, m->desc.transport.ptr, m->desc.transport.slen);
     p += m->desc.transport.slen;
     for (i=0; i<m->desc.fmt_count; ++i) {
-	*p++ = ' ';
-	pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
-	p += m->desc.fmt[i].slen;
+	if (end-p > m->desc.fmt[i].slen) {
+	    *p++ = ' ';
+	    pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
+	    p += m->desc.fmt[i].slen;
+	} else {
+	    return -1;
+	}
+    }
+
+    if (end-p >= 2) {
+	*p++ = '\r';
+	*p++ = '\n';
+    } else {
+	return -1;
     }
-    *p++ = '\r';
-    *p++ = '\n';
 
     /* print connection info, if present. */
     if (m->conn) {
path: pjmedia/src/pjmedia/sdp.c