rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Uncontrolled Resource Consumption in strapi A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
Vulnerability ID: GHSA-23fp-fmrv-f5px
CWE: CWE-400
Severity score: 4.9
Project: https://github.com/strapi/strapi
Published: 2021-12-10
File: packages/strapi-admin/controllers/Admin.js
Commit message: chore(admin): Improve plugin name validator in install/uninstall plugin
Commit author: Alexandre Bodin

Vulnerable version (before fix):
 const formatError = error => [   { messages: [{ id: error.id, message: error.message, field: error.field }] }, ];  /**  * A set of functions called "actions" for `Admin`  */ module.exports = {     try {       const { plugin } = ctx.request.body;        if (!/^[A-Za-z0-9_-]+$/.test(plugin)) {         return ctx.badRequest('Invalid plugin name');       }  module.exports = {     try {       const { plugin } = ctx.params;        if (!/^[A-Za-z0-9_-]+$/.test(plugin)) {         return ctx.badRequest('Invalid plugin name');       } 

Fixed version (after fix):
 const formatError = error => [   { messages: [{ id: error.id, message: error.message, field: error.field }] }, ];  const PLUGIN_NAME_REGEX = /^[A-Za-z][A-Za-z0-9-_]+$/;  /**  * Validates a plugin name format  */ const isValidPluginName = plugin => {   return (     _.isString(plugin) && !_.isEmpty(plugin) && PLUGIN_NAME_REGEX.test(plugin)   ); };  /**  * A set of functions called "actions" for `Admin`  */ module.exports = {     try {       const { plugin } = ctx.request.body;        if (!isValidPluginName(plugin)) {         return ctx.badRequest('Invalid plugin name');       }  module.exports = {     try {       const { plugin } = ctx.params;        if (!isValidPluginName(plugin)) {         return ctx.badRequest('Invalid plugin name');       } 

Patch:
patch: @@ -7,6 +7,17 @@ const formatError = error => [
   { messages: [{ id: error.id, message: error.message, field: error.field }] },
 ];
 
+const PLUGIN_NAME_REGEX = /^[A-Za-z][A-Za-z0-9-_]+$/;
+
+/**
+ * Validates a plugin name format
+ */
+const isValidPluginName = plugin => {
+  return (
+    _.isString(plugin) && !_.isEmpty(plugin) && PLUGIN_NAME_REGEX.test(plugin)
+  );
+};
+
 /**
  * A set of functions called "actions" for `Admin`
  */
@@ -67,7 +78,7 @@ module.exports = {
     try {
       const { plugin } = ctx.request.body;
 
-      if (!/^[A-Za-z0-9_-]+$/.test(plugin)) {
+      if (!isValidPluginName(plugin)) {
         return ctx.badRequest('Invalid plugin name');
       }
 
@@ -107,7 +118,7 @@ module.exports = {
     try {
       const { plugin } = ctx.params;
 
-      if (!/^[A-Za-z0-9_-]+$/.test(plugin)) {
+      if (!isValidPluginName(plugin)) {
         return ctx.badRequest('Invalid plugin name');
       }
path: packages/strapi-admin/controllers/Admin.js
Vulnerability: SQL Injection in sequelize Versions of `sequelize` prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

Upgrade to version 3.35.1 or later.
Vulnerability ID: GHSA-2598-2f59-rmhq
CWE: CWE-89
Severity score: 9.8
Project: https://github.com/sequelize/sequelize
Published: 2019-11-08
File: lib/dialects/abstract/query-generator.js
Commit message: fix(postgres): json path key quoting (#11088)
Commit author: Sushant

Vulnerable version (before fix):
 var QueryGenerator = {             path[path.length - 1] = $tmp[0];           }            $baseKey = self.quoteIdentifier(key)+'#>>\'{'+path.join(', ')+'}\'';            if (options.prefix) {             if (options.prefix instanceof Utils.literal) {

Fixed version (after fix):
 var QueryGenerator = {             path[path.length - 1] = $tmp[0];           }            var pathKey = self.escape('{' + path.join(', ') + '}');           $baseKey = self.quoteIdentifier(key)+'#>>'+pathKey;            if (options.prefix) {             if (options.prefix instanceof Utils.literal) {

Patch:
patch: @@ -2198,7 +2198,8 @@ var QueryGenerator = {
             path[path.length - 1] = $tmp[0];
           }
 
-          $baseKey = self.quoteIdentifier(key)+'#>>\'{'+path.join(', ')+'}\'';
+          var pathKey = self.escape('{' + path.join(', ') + '}');
+          $baseKey = self.quoteIdentifier(key)+'#>>'+pathKey;
 
           if (options.prefix) {
             if (options.prefix instanceof Utils.literal) {
path: lib/dialects/abstract/query-generator.js
Vulnerability: `CHECK`-fail in `MapStage` ### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.MapStage`:

```python
import tensorflow as tf
  
tf.raw_ops.MapStage(
  key=tf.constant([], shape=[0, 0, 0, 0], dtype=tf.int64),
  indices=tf.constant((0), dtype=tf.int32),
  values=[tf.constant((0), dtype=tf.int32)],
  dtypes=[tf.int32,
  tf.int64],
  capacity=0,
  memory_limit=0,
  container='',
  shared_name='')
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/map_stage_op.cc#L513) does not check that the `key` input is a valid non-empty tensor.
  
### Patches
We have patched the issue in GitHub commit [d7de67733925de196ec8863a33445b73f9562d1d](https://github.com/tensorflow/tensorflow/commit/d7de67733925de196ec8863a33445b73f9562d1d).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security  guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability ID: GHSA-278g-rq84-9hmg
CWE: CWE-20
Severity score: 5.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-08-25
File: tensorflow/core/kernels/map_stage_op.cc
Commit message: Prevent a CHECK-fail due to empty tensor input in `map_stage_op.cc`

PiperOrigin-RevId: 387737906
Change-Id: Idc52df0c71c7ed6e2dd633b651a581932f277c8a
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 class MapStageOp : public OpKernel {     OP_REQUIRES_OK(ctx, ctx->input("key", &key_tensor));     OP_REQUIRES_OK(ctx, ctx->input("indices", &indices_tensor));     OP_REQUIRES_OK(ctx, ctx->input_list("values", &values_tensor));      // Create copy for insertion into Staging Area     Tensor key(*key_tensor);

Fixed version (after fix):
 class MapStageOp : public OpKernel {     OP_REQUIRES_OK(ctx, ctx->input("key", &key_tensor));     OP_REQUIRES_OK(ctx, ctx->input("indices", &indices_tensor));     OP_REQUIRES_OK(ctx, ctx->input_list("values", &values_tensor));     OP_REQUIRES(ctx, key_tensor->NumElements() > 0,                 errors::InvalidArgument("key must not be empty"));      // Create copy for insertion into Staging Area     Tensor key(*key_tensor);

Patch:
patch: @@ -527,6 +527,8 @@ class MapStageOp : public OpKernel {
     OP_REQUIRES_OK(ctx, ctx->input("key", &key_tensor));
     OP_REQUIRES_OK(ctx, ctx->input("indices", &indices_tensor));
     OP_REQUIRES_OK(ctx, ctx->input_list("values", &values_tensor));
+    OP_REQUIRES(ctx, key_tensor->NumElements() > 0,
+                errors::InvalidArgument("key must not be empty"));
 
     // Create copy for insertion into Staging Area
     Tensor key(*key_tensor);
path: tensorflow/core/kernels/map_stage_op.cc
Vulnerability: snipe-it is vulnerable to Cross-site Scripting snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability ID: GHSA-2cqg-q7jm-j35c
CWE: CWE-79
Severity score: 3.9
Project: https://github.com/snipe/snipe-it
Published: 2021-11-15
File: app/Http/Controllers/Api/AssetsController.php
Commit message: Merge pull request #10286 from uberbrady/fix_bulk_audit_xss

Escape asset_tag attribute at controller level for bulk checkout
Commit author: snipe

Vulnerable version (before fix):
 public function audit(Request $request) {             }         }          return response()->json(Helper::formatStandardApiResponse('error', ['asset_tag'=> e($request->input('asset_tag'))], 'Asset with tag '.$request->input('asset_tag').' not found'));   

Fixed version (after fix):
 public function audit(Request $request) {             }         }          return response()->json(Helper::formatStandardApiResponse('error', ['asset_tag'=> e($request->input('asset_tag'))], 'Asset with tag '.e($request->input('asset_tag')).' not found'));   

Patch:
patch: @@ -910,7 +910,7 @@ public function audit(Request $request) {
             }
         }
 
-        return response()->json(Helper::formatStandardApiResponse('error', ['asset_tag'=> e($request->input('asset_tag'))], 'Asset with tag '.$request->input('asset_tag').' not found'));
+        return response()->json(Helper::formatStandardApiResponse('error', ['asset_tag'=> e($request->input('asset_tag'))], 'Asset with tag '.e($request->input('asset_tag')).' not found'));
path: app/Http/Controllers/Api/AssetsController.php
Vulnerability: Cross site scripting in librenms LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php.
Vulnerability ID: GHSA-2gqg-2rg7-gh33
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/librenms/librenms
Published: 2022-06-03
File: app/Http/Controllers/Table/GraylogController.php
Commit message: fix graylog xss (#13931)
Commit author: Tony Murray

Vulnerable version (before fix):
 private function formatMessage($message)         return [             'severity'  => $this->severityLabel($level),             'timestamp' => $displayTime,             'source'    => $device ? Url::deviceLink($device) : $message['message']['source'],             'message'   => $message['message']['message'] ?? '',             'facility'  => is_numeric($facility) ? "($facility) " . __("syslog.facility.$facility") : $facility,             'level'     => (is_numeric($level) && $level >= 0) ? "($level) " . __("syslog.severity.$level") : $level,         ];

Fixed version (after fix):
 private function formatMessage($message)         return [             'severity'  => $this->severityLabel($level),             'timestamp' => $displayTime,             'source'    => $device ? Url::deviceLink($device) : htmlspecialchars($message['message']['source']),             'message'   => htmlspecialchars($message['message']['message'] ?? ''),             'facility'  => is_numeric($facility) ? "($facility) " . __("syslog.facility.$facility") : $facility,             'level'     => (is_numeric($level) && $level >= 0) ? "($level) " . __("syslog.severity.$level") : $level,         ];

Patch:
patch: @@ -118,8 +118,8 @@ private function formatMessage($message)
         return [
             'severity'  => $this->severityLabel($level),
             'timestamp' => $displayTime,
-            'source'    => $device ? Url::deviceLink($device) : $message['message']['source'],
-            'message'   => $message['message']['message'] ?? '',
+            'source'    => $device ? Url::deviceLink($device) : htmlspecialchars($message['message']['source']),
+            'message'   => htmlspecialchars($message['message']['message'] ?? ''),
             'facility'  => is_numeric($facility) ? "($facility) " . __("syslog.facility.$facility") : $facility,
             'level'     => (is_numeric($level) && $level >= 0) ? "($level) " . __("syslog.severity.$level") : $level,
         ];
path: app/Http/Controllers/Table/GraylogController.php
Vulnerability: Server-side request forgery (SSRF) in Apache Batik Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Vulnerability ID: GHSA-2h63-qp69-fwvw
CWE: CWE-20
Severity score: 8.2
Project: https://github.com/apache/xmlgraphics-batik
Published: 2022-01-06
File: batik-svgbrowser/src/main/java/org/apache/batik/apps/svgbrowser/NodePickerPanel.java
Commit message: BATIK-1284: Dont load DTDs in NodePickerPanel

git-svn-id: https://svn.apache.org/repos/asf/xmlgraphics/batik/trunk@1878396 13f79535-47bb-0310-9956-ffa450edef68
Commit author: Simon Steiner

Vulnerable version (before fix):
 private Element parseXml(String xmlString) {         Document doc = null;         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();         try {             javax.xml.parsers.DocumentBuilder parser = factory                     .newDocumentBuilder();             parser.setErrorHandler(new ErrorHandler() {                 public void error(SAXParseException exception)                         throws SAXException {

Fixed version (after fix):
 private Element parseXml(String xmlString) {         Document doc = null;         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();         try {             factory.setFeature("http://xml.org/sax/features/external-general-entities", false);             factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);             factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);             javax.xml.parsers.DocumentBuilder parser = factory.newDocumentBuilder();             parser.setErrorHandler(new ErrorHandler() {                 public void error(SAXParseException exception)                         throws SAXException {

Patch:
patch: @@ -847,8 +847,10 @@ private Element parseXml(String xmlString) {
         Document doc = null;
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         try {
-            javax.xml.parsers.DocumentBuilder parser = factory
-                    .newDocumentBuilder();
+            factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+            factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            javax.xml.parsers.DocumentBuilder parser = factory.newDocumentBuilder();
             parser.setErrorHandler(new ErrorHandler() {
                 public void error(SAXParseException exception)
                         throws SAXException {
path: batik-svgbrowser/src/main/java/org/apache/batik/apps/svgbrowser/NodePickerPanel.java
Vulnerability: Spina vulnerable to a cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
Vulnerability ID: GHSA-2hxv-mx8x-mcj9
CWE: CWE-352
Severity score: 8.8
Project: https://github.com/denkGroot/Spina
Published: 2018-08-28
File: app/controllers/spina/application_controller.rb
Commit message: protect from forgery
Commit author: Bram Jetten

Vulnerable version (before fix):
 module Spina   class ApplicationController < ActionController::Base     include ApplicationHelper      private

Fixed version (after fix):
 module Spina   class ApplicationController < ActionController::Base     protect_from_forgery          include ApplicationHelper      private

Patch:
patch: @@ -1,5 +1,7 @@
 module Spina
   class ApplicationController < ActionController::Base
+    protect_from_forgery
+    
     include ApplicationHelper
 
     private
path: app/controllers/spina/application_controller.rb
Vulnerability: BlockWishList SQL Injection vulnerability ### Impact
An authenticated customer can perform SQL injection

### Patches
Issue is fixed in 2.1.1
Vulnerability ID: GHSA-2jx3-5j9v-prpp
CWE: CWE-89
Severity score: 8.1
Project: https://github.com/PrestaShop/blockwishlist
Published: 2022-06-25
File: src/Search/WishListProductSearchProvider.php
Commit message: Merge pull request from GHSA-2jx3-5j9v-prpp

Validate order by and order way
Commit author: atomiix

Vulnerable version (before fix):
 use Product; use Shop; use Symfony\Component\Translation\TranslatorInterface; use WishList;  /** private function getProductsOrCount(          if ('products' === $type) {             $sortOrder = $query->getSortOrder()->toLegacyOrderBy(true);             $querySearch->orderBy($sortOrder . ' ' . $query->getSortOrder()->toLegacyOrderWay());             $querySearch->limit((int) $query->getResultsPerPage(), ((int) $query->getPage() - 1) * (int) $query->getResultsPerPage());             $products = $this->db->executeS($querySearch); 

Fixed version (after fix):
 use Product; use Shop; use Symfony\Component\Translation\TranslatorInterface; use Validate; use WishList;  /** private function getProductsOrCount(          if ('products' === $type) {             $sortOrder = $query->getSortOrder()->toLegacyOrderBy(true);             $sortWay = $query->getSortOrder()->toLegacyOrderWay();             if (Validate::isOrderBy($sortOrder) && Validate::isOrderWay($sortWay)) {                 $querySearch->orderBy($sortOrder . ' ' . $sortWay);             }             $querySearch->limit((int) $query->getResultsPerPage(), ((int) $query->getPage() - 1) * (int) $query->getResultsPerPage());             $products = $this->db->executeS($querySearch); 

Patch:
patch: @@ -35,6 +35,7 @@
 use Product;
 use Shop;
 use Symfony\Component\Translation\TranslatorInterface;
+use Validate;
 use WishList;
 
 /**
@@ -167,7 +168,10 @@ private function getProductsOrCount(
 
         if ('products' === $type) {
             $sortOrder = $query->getSortOrder()->toLegacyOrderBy(true);
-            $querySearch->orderBy($sortOrder . ' ' . $query->getSortOrder()->toLegacyOrderWay());
+            $sortWay = $query->getSortOrder()->toLegacyOrderWay();
+            if (Validate::isOrderBy($sortOrder) && Validate::isOrderWay($sortWay)) {
+                $querySearch->orderBy($sortOrder . ' ' . $sortWay);
+            }
             $querySearch->limit((int) $query->getResultsPerPage(), ((int) $query->getPage() - 1) * (int) $query->getResultsPerPage());
             $products = $this->db->executeS($querySearch);
path: src/Search/WishListProductSearchProvider.php
Vulnerability: django-helpdesk is vulnerable to Cross-site Scripting django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability ID: GHSA-2v5j-q74q-r53f
CWE: CWE-79
Severity score: 8.8
Project: https://github.com/django-helpdesk/django-helpdesk
Published: 2021-12-03
File: helpdesk/models.py
Commit message: Update pattern
Commit author: noobpk

Vulnerable version (before fix):
 def get_markdown(text):     if not text:         return ""      pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\[\s\S\]]*?)\)'     # Regex check     if re.match(pattern, text):         # get get value of group regex

Fixed version (after fix):
 def get_markdown(text):     if not text:         return ""      pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\s\S]*?)\)'     # Regex check     if re.match(pattern, text):         # get get value of group regex

Patch:
patch: @@ -56,7 +56,7 @@ def get_markdown(text):
     if not text:
         return ""
 
-    pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\[\s\S\]]*?)\)'
+    pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\s\S]*?)\)'
     # Regex check
     if re.match(pattern, text):
         # get get value of group regex
path: helpdesk/models.py
Vulnerability: Path Traversal in SharpZipLib SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.
Vulnerability ID: GHSA-2x7h-96h5-rq84
CWE: CWE-22
Severity score: 4
Project: https://github.com/icsharpcode/SharpZipLib
Published: 2022-02-01
File: src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs
Commit message: fix: specialized tar extract traversal
Commit author: nils måsén

Vulnerable version (before fix):
 private void ExtractEntry(string destDir, TarEntry entry, bool allowParentTraver 			name = name.Replace('/', Path.DirectorySeparatorChar);  			string destFile = Path.Combine(destDir, name);  			if (!allowParentTraversal && !Path.GetFullPath(destFile).StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase)) 			{ 				throw new InvalidNameException("Parent traversal in paths is not allowed"); 			}

Fixed version (after fix):
 private void ExtractEntry(string destDir, TarEntry entry, bool allowParentTraver 			name = name.Replace('/', Path.DirectorySeparatorChar);  			string destFile = Path.Combine(destDir, name); 			var destFileDir = Path.GetDirectoryName(Path.GetFullPath(destFile)) ?? "";  			if (!allowParentTraversal && !destFileDir.StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase)) 			{ 				throw new InvalidNameException("Parent traversal in paths is not allowed"); 			}

Patch:
patch: @@ -658,8 +658,9 @@ private void ExtractEntry(string destDir, TarEntry entry, bool allowParentTraver
 			name = name.Replace('/', Path.DirectorySeparatorChar);
 
 			string destFile = Path.Combine(destDir, name);
+			var destFileDir = Path.GetDirectoryName(Path.GetFullPath(destFile)) ?? "";
 
-			if (!allowParentTraversal && !Path.GetFullPath(destFile).StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))
+			if (!allowParentTraversal && !destFileDir.StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase))
 			{
 				throw new InvalidNameException("Parent traversal in paths is not allowed");
 			}
path: src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs
Vulnerability: elgg is vulnerable to Cross-site Scripting elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: GHSA-2xw8-j43j-5vxp
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/elgg/elgg
Published: 2022-01-06
File: mod/reportedcontent/actions/reportedcontent/add.php
Commit message: fix(reported_content): sanitize report URLs
Commit author: Jerôme Bakker

Vulnerable version (before fix):
 $report = new ElggReportedContent(); $report->owner_guid = elgg_get_logged_in_user_guid(); $report->title = $title; $report->address = $address; $report->description = $description; $report->access_id = $access; 

Fixed version (after fix):
 $report = new ElggReportedContent(); $report->owner_guid = elgg_get_logged_in_user_guid(); $report->title = $title; $report->address = elgg_normalize_site_url($address); $report->description = $description; $report->access_id = $access; 

Patch:
patch: @@ -18,7 +18,7 @@
 $report = new ElggReportedContent();
 $report->owner_guid = elgg_get_logged_in_user_guid();
 $report->title = $title;
-$report->address = $address;
+$report->address = elgg_normalize_site_url($address);
 $report->description = $description;
 $report->access_id = $access;
path: mod/reportedcontent/actions/reportedcontent/add.php