rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Stored Cross-site Scripting in ShowDoc ShowDoc prior to version 2.10.4 is vulnerable to stored cross-site scripting viva `axd` and `cshtml` file upload.
Vulnerability ID: GHSA-vpwq-6cp4-ffqc
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/star7th/showdoc
Published: 2022-03-16
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: bug
Commit author: star7th

Vulnerable version (before fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".aspx") 			|| $isDangerStr($filename , ".xsd") 			|| $isDangerStr($filename , ".asa") 		) { 			return true; 		}

Fixed version (after fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".aspx") 			|| $isDangerStr($filename , ".xsd") 			|| $isDangerStr($filename , ".asa") 			|| $isDangerStr($filename , ".cshtml") 			|| $isDangerStr($filename , ".axd") 		) { 			return true; 		}

Patch:
patch: @@ -309,6 +309,8 @@ public function isDangerFilename($filename){
 			|| $isDangerStr($filename , ".aspx")
 			|| $isDangerStr($filename , ".xsd")
 			|| $isDangerStr($filename , ".asa")
+			|| $isDangerStr($filename , ".cshtml")
+			|| $isDangerStr($filename , ".axd")
 		) {
 			return true;
 		}
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: OS Command Injection in Laravel Framework OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
Vulnerability ID: GHSA-w2pm-r78h-4m7v
CWE: CWE-78
Severity score: 8.8
Project: https://github.com/laravel/framework
Published: 2022-01-06
File: src/Illuminate/Filesystem/Filesystem.php
Commit message: use escapeshellarg on windows symlink
Commit author: Taylor Otwell

Vulnerable version (before fix):
 public function link($target, $link)          $mode = $this->isDirectory($target) ? 'J' : 'H';          exec("mklink /{$mode} \"{$link}\" \"{$target}\"");     }      /**

Fixed version (after fix):
 public function link($target, $link)          $mode = $this->isDirectory($target) ? 'J' : 'H';          exec("mklink /{$mode} ".escapeshellarg($link)." ".escapeshellarg($target));     }      /**

Patch:
patch: @@ -254,7 +254,7 @@ public function link($target, $link)
 
         $mode = $this->isDirectory($target) ? 'J' : 'H';
 
-        exec("mklink /{$mode} \"{$link}\" \"{$target}\"");
+        exec("mklink /{$mode} ".escapeshellarg($link)." ".escapeshellarg($target));
     }
 
     /**
path: src/Illuminate/Filesystem/Filesystem.php
Vulnerability: Inefficient Regular Expression Complexity in moment ### Impact

* using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs
* noticeable slowdown is observed with inputs above 10k characters
* users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks

### Patches
The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking.

### Workarounds
In general, given the proliferation of ReDoS attacks, it makes sense to limit the length of the user input to something sane, like 200 characters or less. I haven't seen legitimate cases of date-time strings longer than that, so all moment users who do pass a user-originating string to constructor are encouraged to apply such a rudimentary filter, that would help with this but also most future ReDoS vulnerabilities.

### References
There is an excellent writeup of the issue here: https://github.com/moment/moment/pull/6015#issuecomment-1152961973=

### Details
The issue is rooted in the code that removes legacy comments (stuff inside parenthesis) from strings during rfc2822 parsing. `moment("(".repeat(500000))` will take a few minutes to process, which is unacceptable.
Vulnerability ID: GHSA-wc69-rhjr-hc9g
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/moment/moment
Published: 2022-07-06
File: src/lib/create/from-string.js
Commit message: [bugfix] Fix redos in preprocessRFC2822 regex (#6015)

* fix ReDoS in preprocessRFC2822 regex

Fixes: [#2936](https://github.com/moment/moment/issues/6012)

Disallow nested rfc2822 comments to prevent quadratic regex execution time (i.e each open bracket is considered at most twice).
Commit author: Khang Vo (doublevkay)

Vulnerable version (before fix):
 function untruncateYear(yearStr) { function preprocessRFC2822(s) {     // Remove comments and folding whitespace and replace multiple-spaces with a single space     return s         .replace(/\([^)]*\)|[\n\t]/g, ' ')         .replace(/(\s\s+)/g, ' ')         .replace(/^\s\s*/, '')         .replace(/\s\s*$/, '');

Fixed version (after fix):
 function untruncateYear(yearStr) { function preprocessRFC2822(s) {     // Remove comments and folding whitespace and replace multiple-spaces with a single space     return s         .replace(/\([^()]*\)|[\n\t]/g, ' ')         .replace(/(\s\s+)/g, ' ')         .replace(/^\s\s*/, '')         .replace(/\s\s*$/, '');

Patch:
patch: @@ -151,7 +151,7 @@ function untruncateYear(yearStr) {
 function preprocessRFC2822(s) {
     // Remove comments and folding whitespace and replace multiple-spaces with a single space
     return s
-        .replace(/\([^)]*\)|[\n\t]/g, ' ')
+        .replace(/\([^()]*\)|[\n\t]/g, ' ')
         .replace(/(\s\s+)/g, ' ')
         .replace(/^\s\s*/, '')
         .replace(/\s\s*$/, '');
path: src/lib/create/from-string.js
Vulnerability: Cross-site Scripting in jquery-ui Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
Vulnerability ID: GHSA-wcm2-9c89-wmfm
CWE: CWE-79
Severity score: 0
Project: https://github.com/jquery/jquery-ui
Published: 2017-10-24
File: ui/jquery.ui.dialog.js
Commit message: Dialog: Extract setting the title into a _title method, use .text() to prevent XSS. Fixes #6016 - Dialog: Title XSS Vulnerability.
Commit author: Jörn Zaefferer

Vulnerable version (before fix):
 $.widget("ui.dialog", { 		uiDialogTitle = $( "<span>" ) 			.uniqueId() 			.addClass( "ui-dialog-title" ) 			.html( this.options.title || "&#160;" ) 			.prependTo( this.uiDialogTitlebar );  		this.uiDialog.attr({ 			"aria-labelledby": uiDialogTitle.attr( "id" ) 		}); 	},  	_createButtonPane: function() { 		var uiDialogButtonPane = ( this.uiDialogButtonPane = $( "<div>" ) ) 			.addClass( "ui-dialog-buttonpane ui-widget-content ui-helper-clearfix" ); $.widget("ui.dialog", { 		}  		if ( key === "title" ) { 			// convert whatever was passed in to a string, for html() to not throw up 			$( ".ui-dialog-title", this.uiDialogTitlebar ) 				.html( "" + ( value || "&#160;" ) ); 		} 	}, 

Fixed version (after fix):
 $.widget("ui.dialog", { 		uiDialogTitle = $( "<span>" ) 			.uniqueId() 			.addClass( "ui-dialog-title" ) 			.prependTo( this.uiDialogTitlebar ); 		this._title( uiDialogTitle );  		this.uiDialog.attr({ 			"aria-labelledby": uiDialogTitle.attr( "id" ) 		}); 	},  	_title: function( title ) { 		if ( !this.options.title ) { 			title.html( "&#160;" ); 		} 		title.text( this.options.title ); 	},  	_createButtonPane: function() { 		var uiDialogButtonPane = ( this.uiDialogButtonPane = $( "<div>" ) ) 			.addClass( "ui-dialog-buttonpane ui-widget-content ui-helper-clearfix" ); $.widget("ui.dialog", { 		}  		if ( key === "title" ) { 			this._title( this.uiDialogTitlebar.find( ".ui-dialog-title" ) ); 		} 	}, 

Patch:
patch: @@ -352,14 +352,21 @@ $.widget("ui.dialog", {
 		uiDialogTitle = $( "<span>" )
 			.uniqueId()
 			.addClass( "ui-dialog-title" )
-			.html( this.options.title || "&#160;" )
 			.prependTo( this.uiDialogTitlebar );
+		this._title( uiDialogTitle );
 
 		this.uiDialog.attr({
 			"aria-labelledby": uiDialogTitle.attr( "id" )
 		});
 	},
 
+	_title: function( title ) {
+		if ( !this.options.title ) {
+			title.html( "&#160;" );
+		}
+		title.text( this.options.title );
+	},
+
 	_createButtonPane: function() {
 		var uiDialogButtonPane = ( this.uiDialogButtonPane = $( "<div>" ) )
 			.addClass( "ui-dialog-buttonpane ui-widget-content ui-helper-clearfix" );
@@ -600,9 +607,7 @@ $.widget("ui.dialog", {
 		}
 
 		if ( key === "title" ) {
-			// convert whatever was passed in to a string, for html() to not throw up
-			$( ".ui-dialog-title", this.uiDialogTitlebar )
-				.html( "" + ( value || "&#160;" ) );
+			this._title( this.uiDialogTitlebar.find( ".ui-dialog-title" ) );
 		}
 	},
path: ui/jquery.ui.dialog.js
Vulnerability: Null pointer dereference in TFLite MLIR optimizations ### Impact
An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:

This is caused by the MLIR optimization of `L2NormalizeReduceAxis` operator. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/compiler/mlir/lite/transforms/optimize.cc#L67-L70) unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements:

```cc
bool L2NormalizeReduceAxis(Value sq_op, DenseElementsAttr axis) {
  if (sq_op.getType().cast<ShapedType>().getRank() - 1 ==
          *axis.getValues<int>().begin() ||
      *axis.getValues<int>().begin() == -1) {
      // ...
  }
  // ...
}
```

### Patches
We have patched the issue in GitHub commit [d6b57f461b39fd1aa8c1b870f1b974aac3554955](https://github.com/tensorflow/tensorflow/commit/d6b57f461b39fd1aa8c1b870f1b974aac3554955).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
          
### Attribution              
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability ID: GHSA-wf5p-c75w-w3wh
CWE: CWE-476
Severity score: 7.8
Project: https://github.com/tensorflow/tensorflow
Published: 2021-08-25
File: tensorflow/compiler/mlir/lite/transforms/optimize.cc
Commit message: Prevent nullptr dereference in MLIR TFLite dialect/optimizer.

PiperOrigin-RevId: 387220762
Change-Id: Id136ef04bb3d36123b4685d316ae81a9ec924d6b
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 constexpr char kRelu6[] = "RELU6"; constexpr char kRelu1[] = "RELU_N1_TO_1";  bool L2NormalizeReduceAxis(Value sq_op, DenseElementsAttr axis) {   if (sq_op.getType().cast<ShapedType>().getRank() - 1 ==           *axis.getValues<int>().begin() ||       *axis.getValues<int>().begin() == -1) {

Fixed version (after fix):
 constexpr char kRelu6[] = "RELU6"; constexpr char kRelu1[] = "RELU_N1_TO_1";  bool L2NormalizeReduceAxis(Value sq_op, DenseElementsAttr axis) {   if (axis.getNumElements() == 0) {     return false;   }   if (sq_op.getType().cast<ShapedType>().getRank() - 1 ==           *axis.getValues<int>().begin() ||       *axis.getValues<int>().begin() == -1) {

Patch:
patch: @@ -68,6 +68,9 @@ constexpr char kRelu6[] = "RELU6";
 constexpr char kRelu1[] = "RELU_N1_TO_1";
 
 bool L2NormalizeReduceAxis(Value sq_op, DenseElementsAttr axis) {
+  if (axis.getNumElements() == 0) {
+    return false;
+  }
   if (sq_op.getType().cast<ShapedType>().getRank() - 1 ==
           *axis.getValues<int>().begin() ||
       *axis.getValues<int>().begin() == -1) {
path: tensorflow/compiler/mlir/lite/transforms/optimize.cc
Vulnerability: Cross-site Scripting in ShowDoc ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability ID: GHSA-wg4r-q74r-p7c8
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/star7th/showdoc
Published: 2022-03-15
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: Merge pull request #1630 from ajaysenr/master

Update AttachmentModel.class.php
Commit author: star7th

Vulnerable version (before fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".xml") 			|| $isDangerStr($filename , ".xxhtml") 			|| $isDangerStr($filename , ".asp")			 		) { 			return true; 		}

Fixed version (after fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".xml") 			|| $isDangerStr($filename , ".xxhtml") 			|| $isDangerStr($filename , ".asp")			 			|| $isDangerStr($filename , ".xsl") 		) { 			return true; 		}

Patch:
patch: @@ -305,6 +305,7 @@ public function isDangerFilename($filename){
 			|| $isDangerStr($filename , ".xml")
 			|| $isDangerStr($filename , ".xxhtml")
 			|| $isDangerStr($filename , ".asp")			
+			|| $isDangerStr($filename , ".xsl")
 		) {
 			return true;
 		}
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: Cross-site Scripting in ShowDoc ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Vulnerability ID: GHSA-wg8p-w946-c482
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/star7th/showdoc
Published: 2022-03-16
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: file upload bug
Commit author: star7th

Vulnerable version (before fix):
 public function isAllowedFilename($filename){ 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub', 			'.pdf','.ofd','.swf','.epub','.xps', 			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt', 			'.ppt','.pptx','.xls','.xlsx','.txt','.md','.psd','.csv', 			'.cer','.ppt','.pub','.properties','.json','.css', 			) ; 

Fixed version (after fix):
 public function isAllowedFilename($filename){ 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub', 			'.pdf','.ofd','.swf','.epub','.xps', 			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt', 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv', 			'.cer','.ppt','.pub','.properties','.json','.css', 			) ; 

Patch:
patch: @@ -329,7 +329,7 @@ public function isAllowedFilename($filename){
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
 			'.pdf','.ofd','.swf','.epub','.xps',
 			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt',
-			'.ppt','.pptx','.xls','.xlsx','.txt','.md','.psd','.csv',
+			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
 			'.cer','.ppt','.pub','.properties','.json','.css',
 			) ;
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: Exposure of information in Action Pack ### Impact

Under certain circumstances response bodies will not be closed, for example a [bug in a webserver](https://github.com/puma/puma/pull/2812) or a bug in a Rack middleware.  In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request.  This can lead to data being leaked to subsequent requests, especially when interacting with `ActiveSupport::CurrentAttributes`.

Upgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation.

### Patches

This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

### Workarounds

Upgrading is highly recommended, but to work around this problem the following middleware can be used:

```ruby
class GuardedExecutor < ActionDispatch::Executor
  def call(env)
    ensure_completed!
    super
  end

  private

    def ensure_completed!
      @executor.new.complete! if @executor.active?
    end
end

# Ensure the guard is inserted before ActionDispatch::Executor
Rails.application.configure do
  config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor
end
```
Vulnerability ID: GHSA-wh98-p28r-vrc9
CWE: CWE-200
Severity score: 7.4
Project: https://github.com/rails/rails
Published: 2022-02-11
File: activesupport/lib/active_support/reloader.rb
Commit message: Fix reloader to work with new Executor signature

This is a follow up to [CVE-2022-23633].
Commit author: Aaron Patterson

Vulnerable version (before fix):
 def self.reload!       prepare!     end      def self.run! # :nodoc:       if check!         super       else

Fixed version (after fix):
 def self.reload!       prepare!     end      def self.run!(reset: false) # :nodoc:       if check!         super       else

Patch:
patch: @@ -58,7 +58,7 @@ def self.reload!
       prepare!
     end
 
-    def self.run! # :nodoc:
+    def self.run!(reset: false) # :nodoc:
       if check!
         super
       else
path: activesupport/lib/active_support/reloader.rb
Vulnerability: Cross-site Scripting in RosarioSIS Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
Vulnerability ID: GHSA-wjh9-344g-vc49
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/francoisjacquet/rosariosis
Published: 2022-06-09
File: functions/PreparePHP_SELF.fnc.php
Commit message: Fix stored XSS security issue: remove inline JS from URL in PreparePHP_SELF.fnc.php
Commit author: François Jacquet

Vulnerable version (before fix):
 function( $match ) {  	foreach ( $remove as $remove_string ) 	{ 		while ( strpos( $string, $remove_string ) !== false ) 		{ 			$string = str_ireplace( $remove, '', $string ); 		}

Fixed version (after fix):
 function( $match ) {  	foreach ( $remove as $remove_string ) 	{ 		while ( stripos( $string, $remove_string ) !== false ) 		{ 			$string = str_ireplace( $remove, '', $string ); 		}

Patch:
patch: @@ -200,7 +200,7 @@ function( $match ) {
 
 	foreach ( $remove as $remove_string )
 	{
-		while ( strpos( $string, $remove_string ) !== false )
+		while ( stripos( $string, $remove_string ) !== false )
 		{
 			$string = str_ireplace( $remove, '', $string );
 		}
path: functions/PreparePHP_SELF.fnc.php
Vulnerability: calibre-web is vulnerable to Cross-site Scripting calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: GHSA-wrp6-9w7f-3wxg
CWE: CWE-79
Severity score: 7.3
Project: https://github.com/janeczku/calibre-web
Published: 2022-01-21
File: cps/static/js/edit_books.js
Commit message: Fix upload of cover and book formats containing html characters
Commit author: Ozzie Isaacs

Vulnerable version (before fix):
 $("#btn-upload-format").on("change", function () {     if (filename.substring(3, 11) === "fakepath") {         filename = filename.substring(12);     } // Remove c:\fake at beginning from localhost chrome     $("#upload-format").html(filename); });  $("#btn-upload-cover").on("change", function () {     var filename = $(this).val();     if (filename.substring(3, 11) === "fakepath") {         filename = filename.substring(12);     } // Remove c:\fake at beginning from localhost chrome     $("#upload-cover").html(filename); });  $("#xchange").click(function () {

Fixed version (after fix):
 $("#btn-upload-format").on("change", function () {     if (filename.substring(3, 11) === "fakepath") {         filename = filename.substring(12);     } // Remove c:\fake at beginning from localhost chrome     $("#upload-format").text(filename); });  $("#btn-upload-cover").on("change", function () {     var filename = $(this).val();     if (filename.substring(3, 11) === "fakepath") {         filename = filename.substring(12);     } // Remove c:\fake at beginning from localhost chrome     $("#upload-cover").text(filename); });  $("#xchange").click(function () {

Patch:
patch: @@ -248,15 +248,15 @@ $("#btn-upload-format").on("change", function () {
     if (filename.substring(3, 11) === "fakepath") {
         filename = filename.substring(12);
     } // Remove c:\fake at beginning from localhost chrome
-    $("#upload-format").html(filename);
+    $("#upload-format").text(filename);
 });
 
 $("#btn-upload-cover").on("change", function () {
     var filename = $(this).val();
     if (filename.substring(3, 11) === "fakepath") {
         filename = filename.substring(12);
     } // Remove c:\fake at beginning from localhost chrome
-    $("#upload-cover").html(filename);
+    $("#upload-cover").text(filename);
 });
 
 $("#xchange").click(function () {
path: cps/static/js/edit_books.js
Vulnerability: Cross-site Scripting in moodle A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
Vulnerability ID: GHSA-wvh5-78h5-gmgr
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/moodle/moodle
Published: 2022-05-19
File: mod/assign/classes/output/renderer.php
Commit message: MDL-74204 mod_assign: escape identity fields in allocate marker form.
Commit author: Paul Holden

Vulnerable version (before fix):
 public function render_assign_user_summary(\assign_user_summary $summary) {             $fullname = fullname($summary->user, $summary->viewfullnames);             $extrainfo = array();             foreach ($summary->extrauserfields as $extrafield) {                 $extrainfo[] = $summary->user->$extrafield;             }             if (count($extrainfo)) {                 $fullname .= ' (' . implode(', ', $extrainfo) . ')';

Fixed version (after fix):
 public function render_assign_user_summary(\assign_user_summary $summary) {             $fullname = fullname($summary->user, $summary->viewfullnames);             $extrainfo = array();             foreach ($summary->extrauserfields as $extrafield) {                 $extrainfo[] = s($summary->user->$extrafield);             }             if (count($extrainfo)) {                 $fullname .= ' (' . implode(', ', $extrainfo) . ')';

Patch:
patch: @@ -168,7 +168,7 @@ public function render_assign_user_summary(\assign_user_summary $summary) {
             $fullname = fullname($summary->user, $summary->viewfullnames);
             $extrainfo = array();
             foreach ($summary->extrauserfields as $extrafield) {
-                $extrainfo[] = $summary->user->$extrafield;
+                $extrainfo[] = s($summary->user->$extrafield);
             }
             if (count($extrainfo)) {
                 $fullname .= ' (' . implode(', ', $extrainfo) . ')';
path: mod/assign/classes/output/renderer.php