rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Cross-site scripting in forkcms Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML.
Vulnerability ID: GHSA-3374-7h99-xr85
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/forkcms/forkcms
Published: 2021-10-25
File: src/Backend/Modules/Profiles/Actions/Index.php
Commit message: Fix xss in profiles display name
Commit author: Jelmer Prins

Vulnerable version (before fix):
 private function loadDataGrid(): void             'registered_on',             true         );          // add the mass action controls         $this->dgProfiles->setMassActionCheckboxes('check', '[id]');

Fixed version (after fix):
 private function loadDataGrid(): void             'registered_on',             true         );         $this->dgProfiles->setColumnFunction('htmlspecialchars', ['[display_name]'], 'display_name');          // add the mass action controls         $this->dgProfiles->setMassActionCheckboxes('check', '[id]');

Patch:
patch: @@ -128,6 +128,7 @@ private function loadDataGrid(): void
             'registered_on',
             true
         );
+        $this->dgProfiles->setColumnFunction('htmlspecialchars', ['[display_name]'], 'display_name');
 
         // add the mass action controls
         $this->dgProfiles->setMassActionCheckboxes('check', '[id]');
path: src/Backend/Modules/Profiles/Actions/Index.php
Vulnerability: Node-Redis potential exponential regex in monitor mode ### Impact
When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service.

### Patches
The problem was fixed in commit [`2d11b6d`](https://github.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e) and was released in version `3.1.1`.

### References
#1569 (GHSL-2021-026)
Vulnerability ID: GHSA-35q2-47q7-3pc3
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/NodeRedis/node-redis
Published: 2021-04-27
File: lib/utils.js
Commit message: fix #1569 - improve monitor_regex (#1595)

Co-authored-by: Guy Korland <gkorland@gmail.com>
Commit author: Leibale Eidelman

Vulnerable version (before fix):
 module.exports = {     reply_to_object: replyToObject,     print: print,     err_code: /^([A-Z]+)\s+(.+)$/,     monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\]( ".+?")+$/,     clone: convenienceClone,     callback_or_emit: callbackOrEmit,     reply_in_order: replyInOrder

Fixed version (after fix):
 module.exports = {     reply_to_object: replyToObject,     print: print,     err_code: /^([A-Z]+)\s+(.+)$/,     monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\].*"$/,     clone: convenienceClone,     callback_or_emit: callbackOrEmit,     reply_in_order: replyInOrder

Patch:
patch: @@ -127,7 +127,7 @@ module.exports = {
     reply_to_object: replyToObject,
     print: print,
     err_code: /^([A-Z]+)\s+(.+)$/,
-    monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\]( ".+?")+$/,
+    monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\].*"$/,
     clone: convenienceClone,
     callback_or_emit: callbackOrEmit,
     reply_in_order: replyInOrder
path: lib/utils.js
Vulnerability: Missing Origin Validation in parcel-bundler Versions of `parcel-bundler` before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation

Update to version 1.10.0 or later.
Vulnerability ID: GHSA-37q6-576q-vgr7
CWE: CWE-200
Severity score: 7.5
Project: https://github.com/parcel-bundler/parcel
Published: 2018-10-30
File: packages/core/parcel-bundler/src/HMRServer.js
Commit message: fix security vuln (#1794)
Commit author: Jasper De Moor

Vulnerable version (before fix):
 class HMRServer {         this.server = https.createServer(await getCertificate(options.https));       }        this.wss = new WebSocket.Server({server: this.server});       this.server.listen(options.hmrPort, resolve);     }); 

Fixed version (after fix):
 class HMRServer {         this.server = https.createServer(await getCertificate(options.https));       }        let websocketOptions = {         server: this.server       };        if (options.hmrHostname) {         websocketOptions.origin = `${options.https ? 'https' : 'http'}://${           options.hmrHostname         }`;       }        this.wss = new WebSocket.Server(websocketOptions);       this.server.listen(options.hmrPort, resolve);     }); 

Patch:
patch: @@ -17,7 +17,17 @@ class HMRServer {
         this.server = https.createServer(await getCertificate(options.https));
       }
 
-      this.wss = new WebSocket.Server({server: this.server});
+      let websocketOptions = {
+        server: this.server
+      };
+
+      if (options.hmrHostname) {
+        websocketOptions.origin = `${options.https ? 'https' : 'http'}://${
+          options.hmrHostname
+        }`;
+      }
+
+      this.wss = new WebSocket.Server(websocketOptions);
       this.server.listen(options.hmrPort, resolve);
     });
path: packages/core/parcel-bundler/src/HMRServer.js
Vulnerability: Cross-site Scripting in microweber microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Vulnerability ID: GHSA-38m9-3vg4-rwvp
CWE: CWE-79
Severity score: 6.5
Project: https://github.com/microweber/microweber
Published: 2022-02-20
File: src/MicroweberPackages/Helper/UrlManager.php
Commit message: Update UrlManager.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 public function redirect($url)         $redirectUrl = str_replace("\r", "", $redirectUrl);         $redirectUrl = str_replace("\n", "", $redirectUrl);          if (headers_sent()) {             echo '<meta http-equiv="refresh" content="0;url=' . $redirectUrl . '">';         } else {

Fixed version (after fix):
 public function redirect($url)         $redirectUrl = str_replace("\r", "", $redirectUrl);         $redirectUrl = str_replace("\n", "", $redirectUrl);          $clearInput = new HTMLClean();         $redirectUrl = $clearInput->clean($redirectUrl);          if (headers_sent()) {             echo '<meta http-equiv="refresh" content="0;url=' . $redirectUrl . '">';         } else {

Patch:
patch: @@ -114,6 +114,9 @@ public function redirect($url)
         $redirectUrl = str_replace("\r", "", $redirectUrl);
         $redirectUrl = str_replace("\n", "", $redirectUrl);
 
+        $clearInput = new HTMLClean();
+        $redirectUrl = $clearInput->clean($redirectUrl);
+
         if (headers_sent()) {
             echo '<meta http-equiv="refresh" content="0;url=' . $redirectUrl . '">';
         } else {
path: src/MicroweberPackages/Helper/UrlManager.php
Vulnerability: Uncontrolled Resource Consumption in locutus The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
Vulnerability ID: GHSA-39q4-p535-c852
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/locutusjs/locutus
Published: 2021-06-10
File: src/php/net-gopher/gopher_parsedir.js
Commit message: Prevent ReDos issue with regex inside gopher_parsedir (#446)
Commit author: Rafał Kukawski

Vulnerable version (before fix):
 module.exports = function gopher_parsedir (dirent) { // eslint-disable-line came    * s = Audio file format, primarily a WAV file    */    const entryPattern = /^(.)(.*?)\t(.*?)\t(.*?)\t(.*?)\u000d\u000a$/   const entry = dirent.match(entryPattern)    if (entry === null) {

Fixed version (after fix):
 module.exports = function gopher_parsedir (dirent) { // eslint-disable-line came    * s = Audio file format, primarily a WAV file    */    const entryPattern = /^(.)([^\t]*)\t([^\t]*)\t([^\t]*)\t([^\t]*)\r\n$/   const entry = dirent.match(entryPattern)    if (entry === null) {

Patch:
patch: @@ -22,7 +22,7 @@ module.exports = function gopher_parsedir (dirent) { // eslint-disable-line came
    * s = Audio file format, primarily a WAV file
    */
 
-  const entryPattern = /^(.)(.*?)\t(.*?)\t(.*?)\t(.*?)\u000d\u000a$/
+  const entryPattern = /^(.)([^\t]*)\t([^\t]*)\t([^\t]*)\t([^\t]*)\r\n$/
   const entry = dirent.match(entryPattern)
 
   if (entry === null) {
path: src/php/net-gopher/gopher_parsedir.js
Vulnerability: Improper Authentication in Apache Traffic Control Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as that user without that user's correct password.
Vulnerability ID: GHSA-3f8r-4qwm-r7jf
CWE: CWE-287
Severity score: 9.8
Project: https://github.com/apache/trafficcontrol
Published: 2021-05-18
File: traffic_ops/traffic_ops_golang/login/login.go
Commit message: Improve ldap error handling
Commit author: Rawlin Peters

Vulnerable version (before fix):
 func LoginHandler(db *sqlx.DB, cfg config.Config) http.HandlerFunc { 			handleErrs(http.StatusBadRequest, err) 			return 		} 		resp := struct { 			tc.Alerts 		}{}

Fixed version (after fix):
 func LoginHandler(db *sqlx.DB, cfg config.Config) http.HandlerFunc { 			handleErrs(http.StatusBadRequest, err) 			return 		} 		if form.Username == "" || form.Password == "" { 			api.HandleErr(w, r, nil, http.StatusBadRequest, errors.New("username and password are required"), nil) 			return 		} 		resp := struct { 			tc.Alerts 		}{}

Patch:
patch: @@ -51,6 +51,10 @@ func LoginHandler(db *sqlx.DB, cfg config.Config) http.HandlerFunc {
 			handleErrs(http.StatusBadRequest, err)
 			return
 		}
+		if form.Username == "" || form.Password == "" {
+			api.HandleErr(w, r, nil, http.StatusBadRequest, errors.New("username and password are required"), nil)
+			return
+		}
 		resp := struct {
 			tc.Alerts
 		}{}
path: traffic_ops/traffic_ops_golang/login/login.go
Vulnerability: Prototype Pollution in Dojox The Dojox jQuery wrapper `jqMix` mixin method is vulnerable to Prototype Pollution. 

Affected Area:
```
//https://github.com/dojo/dojox/blob/master/jq.js#L442
		var tobj = {};
		for(var x in props){
			// the "tobj" condition avoid copying properties in "props"
			// inherited from Object.prototype.  For example, if obj has a custom
			// toString() method, don't overwrite it with the toString() method
			// that props inherited from Object.prototype
			if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){
				if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){
					if(dojo.isArray(props[x])){
						obj[x] = props[x];
					}else{
						obj[x] = jqMix(obj[x], props[x]);
					}
				}else{
					obj[x] = props[x];
				}
```
Vulnerability ID: GHSA-3hw5-q855-g6cw
CWE: CWE-94
Severity score: 7.7
Project: https://github.com/dojo/dojox
Published: 2020-03-10
File: jq.js
Commit message: Merge pull request from GHSA-3hw5-q855-g6cw

Prevent the special __proto__ property name from being mixed in to
prevent polluting the prototoype of the object being mixed into in the
jqMix function in jq.js
Commit author: Nick Nisi

Vulnerable version (before fix):
 dojo.query differences that cause some tests to fail: 			// inherited from Object.prototype.  For example, if obj has a custom 			// toString() method, don't overwrite it with the toString() method 			// that props inherited from Object.prototype 			if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){ 				if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){ 					if(dojo.isArray(props[x])){ 						obj[x] = props[x];

Fixed version (after fix):
 dojo.query differences that cause some tests to fail: 			// inherited from Object.prototype.  For example, if obj has a custom 			// toString() method, don't overwrite it with the toString() method 			// that props inherited from Object.prototype 			if(x !== '__proto__ ' && ((tobj[x] === undefined || tobj[x] != props[x])) && props[x] !== undefined && obj != props[x]){ 				if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){ 					if(dojo.isArray(props[x])){ 						obj[x] = props[x];

Patch:
patch: @@ -455,7 +455,7 @@ dojo.query differences that cause some tests to fail:
 			// inherited from Object.prototype.  For example, if obj has a custom
 			// toString() method, don't overwrite it with the toString() method
 			// that props inherited from Object.prototype
-			if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){
+			if(x !== '__proto__ ' && ((tobj[x] === undefined || tobj[x] != props[x])) && props[x] !== undefined && obj != props[x]){
 				if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){
 					if(dojo.isArray(props[x])){
 						obj[x] = props[x];
path: jq.js
Vulnerability: Cross-site Scripting in microweber There is a reflected cross sitem scripting attack in microweber via url parameters.
Vulnerability ID: GHSA-3j58-p785-f27x
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/microweber/microweber
Published: 2022-01-28
File: src/MicroweberPackages/App/Http/Controllers/ApiController.php
Commit message: fix xss on module api call in value parameters
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 class ApiController  extends FrontendController {         public function api_html()     {         if (!defined('MW_API_HTML_OUTPUT')) { public function module()          $request_data = array_merge($_GET, $_POST);           // sanitize attributes         if($request_data){             $request_data_new = [];             $antixss = new AntiXSS();             foreach ($request_data as $k=>$v){                 if(is_string($k)){                     $k = $antixss->xss_clean($k);                     if($k){ public function module()                 } else {                     $request_data_new[$k] = $v;                 }             }             $request_data = $request_data_new;         }

Fixed version (after fix):
 class ApiController  extends FrontendController {      public function api_html()     {         if (!defined('MW_API_HTML_OUTPUT')) { public function module()          $request_data = array_merge($_GET, $_POST);          // sanitize attributes         if($request_data){             $request_data_new = [];             $antixss = new AntiXSS();             foreach ($request_data as $k=>$v){                  $v = $antixss->xss_clean($v);                  if(is_string($k)){                     $k = $antixss->xss_clean($k);                     if($k){ public function module()                 } else {                     $request_data_new[$k] = $v;                 }                              }             $request_data = $request_data_new;         }

Patch:
patch: @@ -17,9 +17,6 @@
 class ApiController  extends FrontendController
 {
 
-
-
-
     public function api_html()
     {
         if (!defined('MW_API_HTML_OUTPUT')) {
@@ -609,12 +606,14 @@ public function module()
 
         $request_data = array_merge($_GET, $_POST);
 
-
         // sanitize attributes
         if($request_data){
             $request_data_new = [];
             $antixss = new AntiXSS();
             foreach ($request_data as $k=>$v){
+
+                $v = $antixss->xss_clean($v);
+
                 if(is_string($k)){
                     $k = $antixss->xss_clean($k);
                     if($k){
@@ -623,6 +622,7 @@ public function module()
                 } else {
                     $request_data_new[$k] = $v;
                 }
+                
             }
             $request_data = $request_data_new;
         }
path: src/MicroweberPackages/App/Http/Controllers/ApiController.php
Vulnerability: Regular Expression Denial of Service in flask-restx Flask RESTX contains a regular expression that is vulnerable to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) (Regular Expression Denial of Service) in `email_regex`.
Vulnerability ID: GHSA-3q6g-vf58-7m4g
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/python-restx/flask-restx
Published: 2021-09-08
File: flask_restx/inputs.py
Commit message: optimize email regex (credits: @kevinbackhouse, fix: #372)
Commit author: ziirish

Vulnerable version (before fix):
 def my_type(value):   email_regex = re.compile(     r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@]+(?:\.[^@]+)*)" r"$",     re.IGNORECASE, ) 

Fixed version (after fix):
 def my_type(value):   email_regex = re.compile(     r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@\.]+(?:\.[^@\.]+)*)" r"$",     re.IGNORECASE, ) 

Patch:
patch: @@ -48,7 +48,7 @@ def my_type(value):
 
 
 email_regex = re.compile(
-    r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@]+(?:\.[^@]+)*)" r"$",
+    r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@\.]+(?:\.[^@\.]+)*)" r"$",
     re.IGNORECASE,
 )
path: flask_restx/inputs.py
Vulnerability: Division by zero in TFLite's implementation of `GatherNd` ### Impact
The reference implementation of the `GatherNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/reference_ops.h#L966):

```cc 
ret.dims_to_count[i] = remain_flat_size / params_shape.Dims(i);
```

An attacker can craft a model such that `params` input would be an empty tensor. In turn, `params_shape.Dims(.)` would be zero, in at least one dimension.

### Patches
We have patched the issue in GitHub commit [8e45822aa0b9f5df4b4c64f221e64dc930a70a9d](https://github.com/tensorflow/tensorflow/commit/8e45822aa0b9f5df4b4c64f221e64dc930a70a9d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability ID: GHSA-3w67-q784-6w7c
CWE: CWE-369
Severity score: 2.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-05-21
File: tensorflow/lite/kernels/gather_nd.cc
Commit message: Handle one more division by 0 in TFLite.

PiperOrigin-RevId: 370800140
Change-Id: I9ab42e5aaccf02f226d1282611490a54cf7d273e
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 TfLiteStatus Eval(TfLiteContext* context, TfLiteNode* node) {   TF_LITE_ENSURE_OK(context,                     GetOutputSafe(context, node, kOutputTensor, &output));    switch (indices->type) {     case kTfLiteInt32:       return EvalGatherNd<int32_t>(context, params, indices, output);

Fixed version (after fix):
 TfLiteStatus Eval(TfLiteContext* context, TfLiteNode* node) {   TF_LITE_ENSURE_OK(context,                     GetOutputSafe(context, node, kOutputTensor, &output));    // Prevent division by 0 in the helper   TF_LITE_ENSURE(context, NumElements(params) > 0);    switch (indices->type) {     case kTfLiteInt32:       return EvalGatherNd<int32_t>(context, params, indices, output);

Patch:
patch: @@ -155,6 +155,9 @@ TfLiteStatus Eval(TfLiteContext* context, TfLiteNode* node) {
   TF_LITE_ENSURE_OK(context,
                     GetOutputSafe(context, node, kOutputTensor, &output));
 
+  // Prevent division by 0 in the helper
+  TF_LITE_ENSURE(context, NumElements(params) > 0);
+
   switch (indices->type) {
     case kTfLiteInt32:
       return EvalGatherNd<int32_t>(context, params, indices, output);
path: tensorflow/lite/kernels/gather_nd.cc
Vulnerability: Improper Neutralization of Special Elements used in an OS Command in Apache ActiveMQ The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.
Vulnerability ID: GHSA-3wfj-vh84-732p
CWE: CWE-78
Severity score: 7.5
Project: https://github.com/apache/activemq
Published: 2022-05-14
File: activemq-broker/src/main/java/org/apache/activemq/broker/TransportConnection.java
Commit message: Remove unused ConnectionControl handling.
Commit author: Timothy Bish

Vulnerable version (before fix):
 public int getProtocolVersion() {      @Override     public Response processControlCommand(ControlCommand command) throws Exception {         String control = command.getCommand();         if (control != null && control.equals("shutdown")) {             System.exit(0);         }         return null;     } 

Fixed version (after fix):
 public int getProtocolVersion() {      @Override     public Response processControlCommand(ControlCommand command) throws Exception {         return null;     } 

Patch:
patch: @@ -1534,10 +1534,6 @@ public int getProtocolVersion() {
 
     @Override
     public Response processControlCommand(ControlCommand command) throws Exception {
-        String control = command.getCommand();
-        if (control != null && control.equals("shutdown")) {
-            System.exit(0);
-        }
         return null;
     }
path: activemq-broker/src/main/java/org/apache/activemq/broker/TransportConnection.java
Vulnerability: OS Command Injection in git-pull-or-clone The package git-pull-or-clone before 2.0.2 is vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
Vulnerability ID: GHSA-3x62-x456-q2vm
CWE: CWE-78
Severity score: 9.8
Project: https://github.com/feross/git-pull-or-clone
Published: 2022-05-03
File: index.js
Commit message: fix: fix command injection vector
Commit author: Liran Tal

Vulnerable version (before fix):
 function gitPullOrClone (url, outPath, opts, cb) {   function gitClone () {     // --depth implies --single-branch     const flag = depth < Infinity ? '--depth=' + depth : '--single-branch'     const args = ['clone', flag, url, outPath]     debug('git ' + args.join(' '))     spawn('git', args, {}, function (err) {       if (err) err.message += ' (git clone) (' + url + ')'

Fixed version (after fix):
 function gitPullOrClone (url, outPath, opts, cb) {   function gitClone () {     // --depth implies --single-branch     const flag = depth < Infinity ? '--depth=' + depth : '--single-branch'     const args = ['clone', flag, '--', url, outPath]     debug('git ' + args.join(' '))     spawn('git', args, {}, function (err) {       if (err) err.message += ' (git clone) (' + url + ')'

Patch:
patch: @@ -28,7 +28,7 @@ function gitPullOrClone (url, outPath, opts, cb) {
   function gitClone () {
     // --depth implies --single-branch
     const flag = depth < Infinity ? '--depth=' + depth : '--single-branch'
-    const args = ['clone', flag, url, outPath]
+    const args = ['clone', flag, '--', url, outPath]
     debug('git ' + args.join(' '))
     spawn('git', args, {}, function (err) {
       if (err) err.message += ' (git clone) (' + url + ')'
path: index.js