rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Cross site scripting via canonical tag in Contao ### Impact
Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end).

### Patches
Update to Contao 4.13.3.

### Workarounds
Disable canonical tags in the root page settings.

### References
https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html

### For more information
If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability ID: GHSA-m8x6-6r63-qvj2
CWE: CWE-79
Severity score: 7.2
Project: https://github.com/contao/contao
Published: 2022-05-20
File: core-bundle/src/Resources/contao/pages/PageRegular.php
Commit message: Merge pull request from GHSA-m8x6-6r63-qvj2
Commit author: Martin Auswöger

Vulnerable version (before fix):
 protected function prepare($objPage) 		$this->Template->pageTitle = str_replace('[-]', '', $this->Template->pageTitle);  		// Meta robots tag 		$this->Template->robots = $headBag->getMetaRobots();  		// Canonical 		if ($objPage->enableCanonical) 		{ 			$this->Template->canonical = $headBag->getCanonicalUriForRequest($request); 		}  		// Fall back to the default title tag

Fixed version (after fix):
 protected function prepare($objPage) 		$this->Template->pageTitle = str_replace('[-]', '', $this->Template->pageTitle);  		// Meta robots tag 		$this->Template->robots = htmlspecialchars($headBag->getMetaRobots());  		// Canonical 		if ($objPage->enableCanonical) 		{ 			$this->Template->canonical = htmlspecialchars($headBag->getCanonicalUriForRequest($request)); 		}  		// Fall back to the default title tag

Patch:
patch: @@ -230,12 +230,12 @@ protected function prepare($objPage)
 		$this->Template->pageTitle = str_replace('[-]', '', $this->Template->pageTitle);
 
 		// Meta robots tag
-		$this->Template->robots = $headBag->getMetaRobots();
+		$this->Template->robots = htmlspecialchars($headBag->getMetaRobots());
 
 		// Canonical
 		if ($objPage->enableCanonical)
 		{
-			$this->Template->canonical = $headBag->getCanonicalUriForRequest($request);
+			$this->Template->canonical = htmlspecialchars($headBag->getCanonicalUriForRequest($request));
 		}
 
 		// Fall back to the default title tag
path: core-bundle/src/Resources/contao/pages/PageRegular.php
Vulnerability: Cross-site Scripting in ShowDoc ShowDoc is vulnerable to stored cross-site scripting through file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability ID: GHSA-mg5h-9rhq-4cqx
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/star7th/showdoc
Published: 2022-03-15
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: file upload bug
Commit author: star7th

Vulnerable version (before fix):
 public function isDangerFilename($filename){ 			 $isDangerStr($filename , ".php") 			|| $isDangerStr($filename , ".svg") 			|| $isDangerStr($filename , ".htm") 			|| $isDangerStr($filename , "%") 			|| $isDangerStr($filename , ".xml") 		) {

Fixed version (after fix):
 public function isDangerFilename($filename){ 			 $isDangerStr($filename , ".php") 			|| $isDangerStr($filename , ".svg") 			|| $isDangerStr($filename , ".htm") 			|| $isDangerStr($filename , ".shtm") 			|| $isDangerStr($filename , "%") 			|| $isDangerStr($filename , ".xml") 		) {

Patch:
patch: @@ -300,6 +300,7 @@ public function isDangerFilename($filename){
 			 $isDangerStr($filename , ".php")
 			|| $isDangerStr($filename , ".svg")
 			|| $isDangerStr($filename , ".htm")
+			|| $isDangerStr($filename , ".shtm")
 			|| $isDangerStr($filename , "%")
 			|| $isDangerStr($filename , ".xml")
 		) {
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: Sinatra has XSS via 400 Bad Request page via params parser exception Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
Vulnerability ID: GHSA-mq35-wqvf-r23c
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/sinatra/sinatra
Published: 2018-06-05
File: lib/sinatra/base.rb
Commit message: escape invalid query params, fixes #1428
Commit author: Kunpei Sakai

Vulnerable version (before fix):
 def unlink?     def params       super     rescue Rack::Utils::ParameterTypeError, Rack::Utils::InvalidParameterError => e       raise BadRequest, "Invalid query parameters: #{e.message}"     end      private

Fixed version (after fix):
 def unlink?     def params       super     rescue Rack::Utils::ParameterTypeError, Rack::Utils::InvalidParameterError => e       raise BadRequest, "Invalid query parameters: #{Rack::Utils.escape_html(e.message)}"     end      private

Patch:
patch: @@ -78,7 +78,7 @@ def unlink?
     def params
       super
     rescue Rack::Utils::ParameterTypeError, Rack::Utils::InvalidParameterError => e
-      raise BadRequest, "Invalid query parameters: #{e.message}"
+      raise BadRequest, "Invalid query parameters: #{Rack::Utils.escape_html(e.message)}"
     end
 
     private
path: lib/sinatra/base.rb
Vulnerability: Integer Overflow or Wraparound in Google TensorFlow Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent.
Vulnerability ID: GHSA-mw6v-crh8-8533
CWE: CWE-190
Severity score: 9.8
Project: https://github.com/tensorflow/tensorflow
Published: 2019-04-30
File: tensorflow/core/lib/io/format.cc
Commit message: Check that n + kBlockTrailerSize does not overflow before reading a block

PiperOrigin-RevId: 191666300
Commit author: Frank Chen

Vulnerable version (before fix):
 See the License for the specific language governing permissions and limitations under the License. ==============================================================================*/  #include "tensorflow/core/lib/io/format.h"  #include "tensorflow/core/lib/core/coding.h" Status ReadBlock(RandomAccessFile* file, const BlockHandle& handle,   // Read the block contents as well as the type/crc footer.   // See table_builder.cc for the code that built this structure.   size_t n = static_cast<size_t>(handle.size());   char* buf = new char[n + kBlockTrailerSize];   StringPiece contents;   Status s = file->Read(handle.offset(), n + kBlockTrailerSize, &contents, buf);

Fixed version (after fix):
 See the License for the specific language governing permissions and limitations under the License. ==============================================================================*/  #include <limits>  #include "tensorflow/core/lib/io/format.h"  #include "tensorflow/core/lib/core/coding.h" Status ReadBlock(RandomAccessFile* file, const BlockHandle& handle,   // Read the block contents as well as the type/crc footer.   // See table_builder.cc for the code that built this structure.   size_t n = static_cast<size_t>(handle.size());    if (kBlockTrailerSize > std::numeric_limits<size_t>::max() - n) {     return errors::DataLoss("handle.size() too big");   }    char* buf = new char[n + kBlockTrailerSize];   StringPiece contents;   Status s = file->Read(handle.offset(), n + kBlockTrailerSize, &contents, buf);

Patch:
patch: @@ -13,6 +13,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 ==============================================================================*/
 
+#include <limits>
+
 #include "tensorflow/core/lib/io/format.h"
 
 #include "tensorflow/core/lib/core/coding.h"
@@ -84,6 +86,11 @@ Status ReadBlock(RandomAccessFile* file, const BlockHandle& handle,
   // Read the block contents as well as the type/crc footer.
   // See table_builder.cc for the code that built this structure.
   size_t n = static_cast<size_t>(handle.size());
+
+  if (kBlockTrailerSize > std::numeric_limits<size_t>::max() - n) {
+    return errors::DataLoss("handle.size() too big");
+  }
+
   char* buf = new char[n + kBlockTrailerSize];
   StringPiece contents;
   Status s = file->Read(handle.offset(), n + kBlockTrailerSize, &contents, buf);
path: tensorflow/core/lib/io/format.cc
Vulnerability: Cross-site Scripting in ShowDoc ShowDoc is vulnerable to stored cross-site scripting through file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability ID: GHSA-mw75-qvfr-hpmr
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/star7th/showdoc
Published: 2022-03-15
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: Merge pull request #1628 from ajaysenr/master

Update AttachmentModel.class.php
Commit author: star7th

Vulnerable version (before fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".shtm") 			|| $isDangerStr($filename , "%") 			|| $isDangerStr($filename , ".xml") 		) { 			return true; 		} public function isDangerFilename($filename){    }\ No newline at end of file

Fixed version (after fix):
 public function isDangerFilename($filename){ 			|| $isDangerStr($filename , ".shtm") 			|| $isDangerStr($filename , "%") 			|| $isDangerStr($filename , ".xml") 			|| $isDangerStr($filename , ".xxhtml") 		) { 			return true; 		} public function isDangerFilename($filename){   \ No newline at end of file }

Patch:
patch: @@ -303,6 +303,7 @@ public function isDangerFilename($filename){
 			|| $isDangerStr($filename , ".shtm")
 			|| $isDangerStr($filename , "%")
 			|| $isDangerStr($filename , ".xml")
+			|| $isDangerStr($filename , ".xxhtml")
 		) {
 			return true;
 		}
@@ -312,4 +313,4 @@ public function isDangerFilename($filename){
 
 
 
-}
\ No newline at end of file
+}
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: Whoogle Search Cross-site Scripting via string parameter The package whoogle-search before 0.7.2 is vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping), meaning the user input is not escaped.
Vulnerability ID: GHSA-mxvc-fwgx-j778
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/benbusby/whoogle-search
Published: 2022-07-15
File: app/templates/error.html
Commit message: Render error message w/o `safe` filter

The error message shown in the error template does not need to be
rendered using the safe filter, and furthermore opens up an XSS
vulnerability.
Commit author: Ben Busby

Vulnerable version (before fix):
 <div>     <h1>Error</h1>     <p>         {{ error_message|safe }}     </p>     <hr>     <p>

Fixed version (after fix):
 <div>     <h1>Error</h1>     <p>         {{ error_message }}     </p>     <hr>     <p>

Patch:
patch: @@ -16,7 +16,7 @@
 <div>
     <h1>Error</h1>
     <p>
-        {{ error_message|safe }}
+        {{ error_message }}
     </p>
     <hr>
     <p>
path: app/templates/error.html
Vulnerability: Denial of Service in miekg-dns A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting new connections.
Vulnerability ID: GHSA-p55x-7x9v-q8m4
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/miekg/dns
Published: 2021-06-29
File: server.go
Commit message: Fix for CVE-2017-15133 TCP DOS (#631)

serveTCP calls reader.ReadTCP in the accept loop rather than in
the per-connection goroutine. If an attacker opens a connection
and leaves it idle, this will block the accept loop until the
connection times out (2s by default). During this time no other
incoming connections will succeed, preventing legitimate queries
from being answered.

This commit moves the call to reader.ReadTCP into the per-connection
goroutine. It also adds a missing call to Close whose absence allowed
file-descirptors to leak in select cases.

This attack and fix have no impact on serving UDP queries.
Commit author: Miek Gieben

Vulnerable version (before fix):
 func (srv *Server) serveTCP(l net.Listener) error { 			} 			return err 		} 		m, err := reader.ReadTCP(rw, rtimeout) 		if err != nil { 			continue 		} 		go srv.serve(rw.RemoteAddr(), handler, m, nil, nil, rw) 	} } 

Fixed version (after fix):
 func (srv *Server) serveTCP(l net.Listener) error { 			} 			return err 		} 		go func() { 			m, err := reader.ReadTCP(rw, rtimeout) 			if err != nil { 				rw.Close() 				return 			} 			srv.serve(rw.RemoteAddr(), handler, m, nil, nil, rw) 		}() 	} } 

Patch:
patch: @@ -472,11 +472,14 @@ func (srv *Server) serveTCP(l net.Listener) error {
 			}
 			return err
 		}
-		m, err := reader.ReadTCP(rw, rtimeout)
-		if err != nil {
-			continue
-		}
-		go srv.serve(rw.RemoteAddr(), handler, m, nil, nil, rw)
+		go func() {
+			m, err := reader.ReadTCP(rw, rtimeout)
+			if err != nil {
+				rw.Close()
+				return
+			}
+			srv.serve(rw.RemoteAddr(), handler, m, nil, nil, rw)
+		}()
 	}
 }
path: server.go
Vulnerability: MPXJ path Traversal vulnerability common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.
Vulnerability ID: GHSA-p9j6-4pjr-gp48
CWE: CWE-22
Severity score: 5.3
Project: https://github.com/joniles/mpxj
Published: 2020-12-18
File: src/main/java/net/sf/mpxj/common/InputStreamHelper.java
Commit message: zip slip fix
Commit author: Jon Iles

Vulnerable version (before fix):
 public static File writeZipStreamToTempDir(InputStream inputStream) throws IOExc     */    private static void processZipStream(File dir, InputStream inputStream) throws IOException    {       ZipInputStream zip = new ZipInputStream(inputStream);       while (true)       { private static void processZipStream(File dir, InputStream inputStream) throws I          }           File file = new File(dir, entry.getName());          if (entry.isDirectory())          {             FileHelper.mkdirsQuietly(file);

Fixed version (after fix):
 public static File writeZipStreamToTempDir(InputStream inputStream) throws IOExc     */    private static void processZipStream(File dir, InputStream inputStream) throws IOException    {       String canonicalDestinationDirPath = dir.getCanonicalPath();       ZipInputStream zip = new ZipInputStream(inputStream);       while (true)       { private static void processZipStream(File dir, InputStream inputStream) throws I          }           File file = new File(dir, entry.getName());           // https://snyk.io/research/zip-slip-vulnerability          String canonicalDestinationFile = file.getCanonicalPath();          if (!canonicalDestinationFile.startsWith(canonicalDestinationDirPath + File.separator))          {             throw new IOException("Entry is outside of the target dir: " + entry.getName());          }           if (entry.isDirectory())          {             FileHelper.mkdirsQuietly(file);

Patch:
patch: @@ -114,6 +114,7 @@ public static File writeZipStreamToTempDir(InputStream inputStream) throws IOExc
     */
    private static void processZipStream(File dir, InputStream inputStream) throws IOException
    {
+      String canonicalDestinationDirPath = dir.getCanonicalPath();
       ZipInputStream zip = new ZipInputStream(inputStream);
       while (true)
       {
@@ -124,6 +125,14 @@ private static void processZipStream(File dir, InputStream inputStream) throws I
          }
 
          File file = new File(dir, entry.getName());
+
+         // https://snyk.io/research/zip-slip-vulnerability
+         String canonicalDestinationFile = file.getCanonicalPath();
+         if (!canonicalDestinationFile.startsWith(canonicalDestinationDirPath + File.separator))
+         {
+            throw new IOException("Entry is outside of the target dir: " + entry.getName());
+         }
+
          if (entry.isDirectory())
          {
             FileHelper.mkdirsQuietly(file);
path: src/main/java/net/sf/mpxj/common/InputStreamHelper.java
Vulnerability: Cross-site Scripting vulnerability in Mautic's tracking pixel functionality ### Impact

Mautic allows you to track open rates by using tracking pixels. 
The tracking information is stored together with extra metadata of the tracking request.

The output isn't sufficiently filtered when showing the metadata of the tracking information, which may lead to a vulnerable situation.

### Patches

Please upgrade to 4.3.0

### Workarounds
None.

### References
* Internally tracked under MST-38

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability ID: GHSA-pjpc-87mp-4332
CWE: CWE-79
Severity score: 9.6
Project: https://github.com/mautic/mautic
Published: 2022-05-25
File: app/bundles/EmailBundle/Views/SubscribedEvents/Timeline/index.html.php
Commit message: Merge pull request from GHSA-pjpc-87mp-4332

* sanitise user agent before displaying

* Update app/bundles/EmailBundle/Views/SubscribedEvents/Timeline/index.html.php

Co-authored-by: John Linhart <admin@escope.cz>

* removed obsolete use statement

Co-authored-by: John Linhart <admin@escope.cz>
Commit author: mollux

Vulnerable version (before fix):
  *  * @license     GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html  */ if ($item = ((isset($event['extra'])) ? $event['extra']['stat'] : false)): ?>     <p>         <?php if (!empty($item['isFailed'])) : ?>             endif;             ?>             <?php if ($counter > 1): ?><hr/><?php endif; ?>             <strong><?php echo $view['date']->toText($detail['datetime'], 'UTC'); ?></strong><br/><?php echo $detail['useragent']; ?>             <?php ++$counter; ?>         <?php endforeach; ?>         <?php

Fixed version (after fix):
  *  * @license     GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html  */  if ($item = ((isset($event['extra'])) ? $event['extra']['stat'] : false)): ?>     <p>         <?php if (!empty($item['isFailed'])) : ?>             endif;             ?>             <?php if ($counter > 1): ?><hr/><?php endif; ?>             <strong><?php echo $view['date']->toText($detail['datetime'], 'UTC'); ?></strong><br/><?php echo $view->escape($detail['useragent']); ?>             <?php ++$counter; ?>         <?php endforeach; ?>         <?php

Patch:
patch: @@ -8,6 +8,7 @@
  *
  * @license     GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html
  */
+
 if ($item = ((isset($event['extra'])) ? $event['extra']['stat'] : false)): ?>
     <p>
         <?php if (!empty($item['isFailed'])) : ?>
@@ -63,7 +64,7 @@
             endif;
             ?>
             <?php if ($counter > 1): ?><hr/><?php endif; ?>
-            <strong><?php echo $view['date']->toText($detail['datetime'], 'UTC'); ?></strong><br/><?php echo $detail['useragent']; ?>
+            <strong><?php echo $view['date']->toText($detail['datetime'], 'UTC'); ?></strong><br/><?php echo $view->escape($detail['useragent']); ?>
             <?php ++$counter; ?>
         <?php endforeach; ?>
         <?php
path: app/bundles/EmailBundle/Views/SubscribedEvents/Timeline/index.html.php
Vulnerability: Division by zero in TFLite's implementation of `SVDF` ### Impact
The implementation of the `SVDF` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/7f283ff806b2031f407db64c4d3edcda8fb9f9f5/tensorflow/lite/kernels/svdf.cc#L99-L102):

```cc
const int rank = params->rank;
...
TF_LITE_ENSURE_EQ(context, num_filters % rank, 0);
```

An attacker can craft a model such that `params->rank` would be 0.

### Patches
We have patched the issue in GitHub commit [6841e522a3e7d48706a02e8819836e809f738682](https://github.com/tensorflow/tensorflow/commit/6841e522a3e7d48706a02e8819836e809f738682).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability ID: GHSA-pmpr-55fj-r229
CWE: CWE-369
Severity score: 2.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-05-21
File: tensorflow/lite/kernels/svdf.cc
Commit message: Prevent division by 0

PiperOrigin-RevId: 370995582
Change-Id: I670ffaf52d1ff8823ec31ea5f438f9125b402223
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {   const int rank = params->rank;   const int batch_size = input->dims->data[0];   const int num_filters = weights_feature->dims->data[0];   TF_LITE_ENSURE_EQ(context, num_filters % rank, 0);   const int num_units = num_filters / rank;   const int memory_size = weights_time->dims->data[1];

Fixed version (after fix):
 TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {   const int rank = params->rank;   const int batch_size = input->dims->data[0];   const int num_filters = weights_feature->dims->data[0];   TF_LITE_ENSURE(context, rank != 0);   TF_LITE_ENSURE_EQ(context, num_filters % rank, 0);   const int num_units = num_filters / rank;   const int memory_size = weights_time->dims->data[1];

Patch:
patch: @@ -99,6 +99,7 @@ TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {
   const int rank = params->rank;
   const int batch_size = input->dims->data[0];
   const int num_filters = weights_feature->dims->data[0];
+  TF_LITE_ENSURE(context, rank != 0);
   TF_LITE_ENSURE_EQ(context, num_filters % rank, 0);
   const int num_units = num_filters / rank;
   const int memory_size = weights_time->dims->data[1];
path: tensorflow/lite/kernels/svdf.cc
Vulnerability: Improper synchronization in Apache Netbeans HTML/Java API There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file.
Vulnerability ID: GHSA-ppc3-fpvh-7396
CWE: CWE-362
Severity score: 7
Project: https://github.com/apache/netbeans-html4j
Published: 2022-02-09
File: webkit/src/main/java/org/netbeans/html/presenters/webkit/UnJarResources.java
Commit message: createTempDirectory atomically
Commit author: Jaroslav Tulach

Vulnerable version (before fix):
 static URL extract(URL url) throws IOException {         if (jar == null) {             return url;         }         File dir = File.createTempFile(jar.getName(), ".dir");         dir.delete();         dir.mkdirs();          Enumeration<JarEntry> en = jar.entries();         while (en.hasMoreElements()) {

Fixed version (after fix):
 static URL extract(URL url) throws IOException {         if (jar == null) {             return url;         }         File dir = Files.createTempDirectory(jar.getName() + ".dir").toFile();          Enumeration<JarEntry> en = jar.entries();         while (en.hasMoreElements()) {

Patch:
patch: @@ -39,9 +39,7 @@ static URL extract(URL url) throws IOException {
         if (jar == null) {
             return url;
         }
-        File dir = File.createTempFile(jar.getName(), ".dir");
-        dir.delete();
-        dir.mkdirs();
+        File dir = Files.createTempDirectory(jar.getName() + ".dir").toFile();
 
         Enumeration<JarEntry> en = jar.entries();
         while (en.hasMoreElements()) {
path: webkit/src/main/java/org/netbeans/html/presenters/webkit/UnJarResources.java