rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive information. The vulnerability has been fixed in version 4.8.3
Vulnerability ID: CVE-2020-15124
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/intranda/goobi-viewer-core
Published: 2020-07-22
File: goobi-viewer-core/src/main/java/io/goobi/viewer/controller/DataFileTools.java
Commit message: Don't allow filepaths as Filename when requesting source files
Commit author: Florian Alpers

Vulnerable version (before fix):
 public static Path getDataFolder(String pi, String dataFolderName, String dataRe      */     public static Path getDataFilePath(String pi, String dataFolderName, String altDataFolderName, String fileName)             throws PresentationException, IndexUnreachableException {         java.nio.file.Path dataFolderPath = getDataFolder(pi, dataFolderName);         if (StringUtils.isNotBlank(fileName)) {             dataFolderPath = dataFolderPath.resolve(fileName);

Fixed version (after fix):
 public static Path getDataFolder(String pi, String dataFolderName, String dataRe      */     public static Path getDataFilePath(String pi, String dataFolderName, String altDataFolderName, String fileName)             throws PresentationException, IndexUnreachableException {         //make sure fileName is a pure filename and not a path         fileName = Paths.get(fileName).getFileName().toString();         java.nio.file.Path dataFolderPath = getDataFolder(pi, dataFolderName);         if (StringUtils.isNotBlank(fileName)) {             dataFolderPath = dataFolderPath.resolve(fileName);

Patch:
patch: @@ -186,6 +186,8 @@ public static Path getDataFolder(String pi, String dataFolderName, String dataRe
      */
     public static Path getDataFilePath(String pi, String dataFolderName, String altDataFolderName, String fileName)
             throws PresentationException, IndexUnreachableException {
+        //make sure fileName is a pure filename and not a path
+        fileName = Paths.get(fileName).getFileName().toString();
         java.nio.file.Path dataFolderPath = getDataFolder(pi, dataFolderName);
         if (StringUtils.isNotBlank(fileName)) {
             dataFolderPath = dataFolderPath.resolve(fileName);
path: goobi-viewer-core/src/main/java/io/goobi/viewer/controller/DataFileTools.java
Vulnerability: NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.
Vulnerability ID: CVE-2020-15149
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/NodeBB/NodeBB
Published: 2020-08-20
File: src/user/profile.js
Commit message: fix: improper targetUid check during password change
Commit author: Julian Lam

Vulnerable version (before fix):
 module.exports = function (User) { 		} 		let isAdminOrPasswordMatch = false; 		const isSelf = parseInt(uid, 10) === parseInt(data.uid, 10); 		if ( 			(isAdmin && !isSelf) || // Admins ok 			(!hasPassword && isSelf)	// Initial password set ok 		) { 			isAdminOrPasswordMatch = true; 		} else { 			isAdminOrPasswordMatch = await User.isPasswordCorrect(uid, data.currentPassword, data.ip); 		}  		if (!isAdminOrPasswordMatch) {

Fixed version (after fix):
 module.exports = function (User) { 		} 		let isAdminOrPasswordMatch = false; 		const isSelf = parseInt(uid, 10) === parseInt(data.uid, 10);  		if (!isAdmin && !isSelf) { 			throw new Error('[[user:change_password_error_privileges]]'); 		}  		if ( 			(isAdmin && !isSelf) || // Admins ok 			(!hasPassword && isSelf)	// Initial password set ok 		) { 			isAdminOrPasswordMatch = true; 		} else { 			isAdminOrPasswordMatch = await User.isPasswordCorrect(data.uid, data.currentPassword, data.ip); 		}  		if (!isAdminOrPasswordMatch) {

Patch:
patch: @@ -280,13 +280,18 @@ module.exports = function (User) {
 		}
 		let isAdminOrPasswordMatch = false;
 		const isSelf = parseInt(uid, 10) === parseInt(data.uid, 10);
+
+		if (!isAdmin && !isSelf) {
+			throw new Error('[[user:change_password_error_privileges]]');
+		}
+
 		if (
 			(isAdmin && !isSelf) || // Admins ok
 			(!hasPassword && isSelf)	// Initial password set ok
 		) {
 			isAdminOrPasswordMatch = true;
 		} else {
-			isAdminOrPasswordMatch = await User.isPasswordCorrect(uid, data.currentPassword, data.ip);
+			isAdminOrPasswordMatch = await User.isPasswordCorrect(data.uid, data.currentPassword, data.ip);
 		}
 
 		if (!isAdminOrPasswordMatch) {
path: src/user/profile.js
Vulnerability: In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2.
Vulnerability ID: CVE-2020-15177
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/glpi-project/glpi
Published: 2020-10-07
File: install/install.php
Commit message: Merge pull request from GHSA-prvh-9m4h-4m79
Commit author: Cédric Anne

Vulnerable version (before fix):
 function checkConfigFile() {    } }  if (!isset($_POST["install"])) {    $_SESSION = [];     checkConfigFile();    header_html("Select your language");    choose_language(); 

Fixed version (after fix):
 function checkConfigFile() {    } }  if (!isset($_SESSION['can_process_install']) || !isset($_POST["install"])) {    $_SESSION = [];     checkConfigFile();     // Add a flag that will be used to validate that installation can be processed.    // This flag is put here just after checking that DB config file does not exist yet.    // It is mandatory to validate that `Etape_4` to `Etape_6` are not used outside installation process    // to change GLPI base URL without even being authenticated.    $_SESSION['can_process_install'] = true;     header_html("Select your language");    choose_language(); 

Patch:
patch: @@ -598,10 +598,17 @@ function checkConfigFile() {
    }
 }
 
-if (!isset($_POST["install"])) {
+if (!isset($_SESSION['can_process_install']) || !isset($_POST["install"])) {
    $_SESSION = [];
 
    checkConfigFile();
+
+   // Add a flag that will be used to validate that installation can be processed.
+   // This flag is put here just after checking that DB config file does not exist yet.
+   // It is mandatory to validate that `Etape_4` to `Etape_6` are not used outside installation process
+   // to change GLPI base URL without even being authenticated.
+   $_SESSION['can_process_install'] = true;
+
    header_html("Select your language");
    choose_language();
path: install/install.php
Vulnerability: The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.
Vulnerability ID: CVE-2020-15179
CWE: CWE-79
Severity score: 6.4
Project: https://github.com/InternationalScratchWiki/wiki-scratchsig
Published: 2020-09-15
File: ScratchSig2.php
Commit message: <scratchsig><script>location='https://www.youtube.com/watch?v=dQw4w9WgXcQ';</script></scratchsig>
Commit author: Naleksuh

Vulnerable version (before fix):
 function sigGetAvatarUrl ($username) { // Called to output HTML for <scratchsig> tag  function sigRenderTag ($input, array $args, Parser $parser, PPFrame $frame) {     $username = $input;      $img_url = sigGetAvatarUrl($username); 

Fixed version (after fix):
 function sigGetAvatarUrl ($username) { // Called to output HTML for <scratchsig> tag  function sigRenderTag ($input, array $args, Parser $parser, PPFrame $frame) {     $username = htmlspecialchars($input);      $img_url = sigGetAvatarUrl($username); 

Patch:
patch: @@ -67,7 +67,7 @@ function sigGetAvatarUrl ($username) {
 // Called to output HTML for <scratchsig> tag
 
 function sigRenderTag ($input, array $args, Parser $parser, PPFrame $frame) {
-    $username = $input;
+    $username = htmlspecialchars($input);
 
     $img_url = sigGetAvatarUrl($username);
path: ScratchSig2.php
Vulnerability: SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.
Vulnerability ID: CVE-2020-15183
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/inunosinsi/soycms
Published: 2020-09-17
File: cms/app/webapp/inquiry/admin.php
Commit message: Merge pull request #13 from stypr/xss-patch

Fix Cross-Site Scripting: Print error message instead
Commit author: Tsuyoshi Saito

Vulnerable version (before fix):
 function main(){ 		}  		if(!SOY2HTMLFactory::pageExists($classPath)){ 			return $classPath; 		}  		$webPage = &SOY2HTMLFactory::createInstance($classPath, array(

Fixed version (after fix):
 function main(){ 		}  		if(!SOY2HTMLFactory::pageExists($classPath)){ 			return "エラーが発生しました。"; 		}  		$webPage = &SOY2HTMLFactory::createInstance($classPath, array(

Patch:
patch: @@ -121,7 +121,7 @@ function main(){
 		}
 
 		if(!SOY2HTMLFactory::pageExists($classPath)){
-			return $classPath;
+			return "エラーが発生しました。";
 		}
 
 		$webPage = &SOY2HTMLFactory::createInstance($classPath, array(
path: cms/app/webapp/inquiry/admin.php
Vulnerability: In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.
Vulnerability ID: CVE-2020-15217
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/glpi-project/glpi
Published: 2020-10-07
File: inc/knowbaseitem.class.php
Commit message: Merge pull request from GHSA-x9hg-j29f-wvvv
Commit author: Cédric Anne

Vulnerable version (before fix):
 static function getListRequest(array $params, $type = 'search') {                 }                 $search_where = ['OR' => $ors];                 // Add visibility date                $visibility_crit = [

Fixed version (after fix):
 static function getListRequest(array $params, $type = 'search') {                 }                 $search_where =  $criteria['WHERE']; // Visibility restrict criteria                 $search_where[] = ['OR' => $ors];                 // Add visibility date                $visibility_crit = [

Patch:
patch: @@ -1292,7 +1292,9 @@ static function getListRequest(array $params, $type = 'search') {
 
                }
 
-               $search_where = ['OR' => $ors];
+               $search_where =  $criteria['WHERE']; // Visibility restrict criteria
+
+               $search_where[] = ['OR' => $ors];
 
                // Add visibility date
                $visibility_crit = [
path: inc/knowbaseitem.class.php
Vulnerability: In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
Vulnerability ID: CVE-2020-15476
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ntop/nDPI
Published: 2020-07-01
File: src/lib/protocols/oracle.c
Commit message: Adds bound check in oracle protocol

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21780
Commit author: Philippe Antoine

Vulnerable version (before fix):
 void ndpi_search_oracle(struct ndpi_detection_module_struct *ndpi_struct, struct     NDPI_LOG_DBG2(ndpi_struct, "calculating ORACLE over tcp\n");     /* Oracle Database 9g,10g,11g */     if ((dport == 1521 || sport == 1521) 	&&  (((packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00)) 	     || ((packet->payload_packet_len >= 232) && ((packet->payload[0] == 0x00) || (packet->payload[0] == 0x01))  	     && (packet->payload[1] != 0x00) 	     && (packet->payload[2] == 0x00)

Fixed version (after fix):
 void ndpi_search_oracle(struct ndpi_detection_module_struct *ndpi_struct, struct     NDPI_LOG_DBG2(ndpi_struct, "calculating ORACLE over tcp\n");     /* Oracle Database 9g,10g,11g */     if ((dport == 1521 || sport == 1521) 	&&  (((packet->payload_packet_len >= 3 && packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00)) 	     || ((packet->payload_packet_len >= 232) && ((packet->payload[0] == 0x00) || (packet->payload[0] == 0x01))  	     && (packet->payload[1] != 0x00) 	     && (packet->payload[2] == 0x00)

Patch:
patch: @@ -43,7 +43,7 @@ void ndpi_search_oracle(struct ndpi_detection_module_struct *ndpi_struct, struct
     NDPI_LOG_DBG2(ndpi_struct, "calculating ORACLE over tcp\n");
     /* Oracle Database 9g,10g,11g */
     if ((dport == 1521 || sport == 1521)
-	&&  (((packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))
+	&&  (((packet->payload_packet_len >= 3 && packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))
 	     || ((packet->payload_packet_len >= 232) && ((packet->payload[0] == 0x00) || (packet->payload[0] == 0x01)) 
 	     && (packet->payload[1] != 0x00)
 	     && (packet->payload[2] == 0x00)
path: src/lib/protocols/oracle.c
Vulnerability: PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
Vulnerability ID: CVE-2020-15569
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/milkytracker/MilkyTracker
Published: 2020-07-06
File: src/milkyplay/PlayerGeneric.cpp
Commit message: Fix use-after-free in PlayerGeneric destructor
Commit author: Jeremy Clarke

Vulnerable version (before fix):
 PlayerGeneric::PlayerGeneric(mp_sint32 frequency, AudioDriverInterface* audioDri 	 PlayerGeneric::~PlayerGeneric() { 	if (mixer) 		delete mixer;  	if (player) 	{ 		if (mixer->isActive() && !mixer->isDeviceRemoved(player)) 			mixer->removeDevice(player); 		delete player; 	}  	delete[] audioDriverName; 	

Fixed version (after fix):
 PlayerGeneric::PlayerGeneric(mp_sint32 frequency, AudioDriverInterface* audioDri 	 PlayerGeneric::~PlayerGeneric() {  	if (player) 	{ 		if (mixer && mixer->isActive() && !mixer->isDeviceRemoved(player)) 			mixer->removeDevice(player); 		delete player; 	} 	 	if (mixer) 		delete mixer;  	delete[] audioDriverName; 	

Patch:
patch: @@ -202,15 +202,16 @@ PlayerGeneric::PlayerGeneric(mp_sint32 frequency, AudioDriverInterface* audioDri
 	
 PlayerGeneric::~PlayerGeneric()
 {
-	if (mixer)
-		delete mixer;
 
 	if (player)
 	{
-		if (mixer->isActive() && !mixer->isDeviceRemoved(player))
+		if (mixer && mixer->isActive() && !mixer->isDeviceRemoved(player))
 			mixer->removeDevice(player);
 		delete player;
 	}
+	
+	if (mixer)
+		delete mixer;
 
 	delete[] audioDriverName;
path: src/milkyplay/PlayerGeneric.cpp
Vulnerability: In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php.
Vulnerability ID: CVE-2020-15873
CWE: CWE-89
Severity score: 2.9
Project: https://github.com/librenms/librenms
Published: 2020-07-21
File: includes/html/forms/customoid.inc.php
Commit message: Fix sql injection (#11923)

in custom oid code

Thanks to loginsoft p.v.t l.t.d india for the report!
Website: https://www.loginsoft.com/
Commit author: Tony Murray

Vulnerable version (before fix):
 }  if ($action == "test") {     $query = "SELECT * FROM `devices` WHERE `device_id` = $device_id LIMIT 1";     $device = dbFetchRow($query);      $rawdata = snmp_get($device, $oid, '-Oqv'); 

Fixed version (after fix):
 }  if ($action == "test") {     $query = "SELECT * FROM `devices` WHERE `device_id` = ? LIMIT 1";     $device = dbFetchRow($query, [$device_id]);      $rawdata = snmp_get($device, $oid, '-Oqv'); 

Patch:
patch: @@ -72,8 +72,8 @@
 }
 
 if ($action == "test") {
-    $query = "SELECT * FROM `devices` WHERE `device_id` = $device_id LIMIT 1";
-    $device = dbFetchRow($query);
+    $query = "SELECT * FROM `devices` WHERE `device_id` = ? LIMIT 1";
+    $device = dbFetchRow($query, [$device_id]);
 
     $rawdata = snmp_get($device, $oid, '-Oqv');
path: includes/html/forms/customoid.inc.php
Vulnerability: Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.
Vulnerability ID: CVE-2020-15889
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/lua/lua
Published: 2020-07-21
File: lgc.c
Commit message: Fixed bug of old finalized objects in the GC

When an object aged OLD1 is finalized, it is moved from the list
'finobj' to the *beginning* of the list 'allgc'. So, this part of the
list (and not only the survival list) must be visited by 'markold'.
Commit author: Roberto Ierusalimschy

Vulnerable version (before fix):
 static void finishgencycle (lua_State *L, global_State *g) {   /* ** Does a young collection. First, mark 'OLD1' objects.  (Only survival ** and "recent old" lists can contain 'OLD1' objects. New lists cannot ** contain 'OLD1' objects, at most 'OLD0' objects that were already ** visited when marked old.) Then does the atomic step. Then, ** sweep all lists and advance pointers. Finally, finish the collection. */ static void youngcollection (lua_State *L, global_State *g) {   GCObject **psurvival;  /* to point to first non-dead survival object */   lua_assert(g->gcstate == GCSpropagate);   markold(g, g->survival, g->reallyold);   markold(g, g->finobj, g->finobjrold);   atomic(L); 

Fixed version (after fix):
 static void finishgencycle (lua_State *L, global_State *g) {   /* ** Does a young collection. First, mark 'OLD1' objects. Then does the ** atomic step. Then, sweep all lists and advance pointers. Finally, ** finish the collection. */ static void youngcollection (lua_State *L, global_State *g) {   GCObject **psurvival;  /* to point to first non-dead survival object */   lua_assert(g->gcstate == GCSpropagate);   markold(g, g->allgc, g->reallyold);   markold(g, g->finobj, g->finobjrold);   atomic(L); 

Patch:
patch: @@ -1131,16 +1131,14 @@ static void finishgencycle (lua_State *L, global_State *g) {
 
 
 /*
-** Does a young collection. First, mark 'OLD1' objects.  (Only survival
-** and "recent old" lists can contain 'OLD1' objects. New lists cannot
-** contain 'OLD1' objects, at most 'OLD0' objects that were already
-** visited when marked old.) Then does the atomic step. Then,
-** sweep all lists and advance pointers. Finally, finish the collection.
+** Does a young collection. First, mark 'OLD1' objects. Then does the
+** atomic step. Then, sweep all lists and advance pointers. Finally,
+** finish the collection.
 */
 static void youngcollection (lua_State *L, global_State *g) {
   GCObject **psurvival;  /* to point to first non-dead survival object */
   lua_assert(g->gcstate == GCSpropagate);
-  markold(g, g->survival, g->reallyold);
+  markold(g, g->allgc, g->reallyold);
   markold(g, g->finobj, g->finobjrold);
   atomic(L);
path: lgc.c
Vulnerability: A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
Vulnerability ID: CVE-2020-15900
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/ArtifexSoftware/ghostpdl
Published: 2020-07-28
File: psi/zstring.c
Commit message: Bug 702582, CVE 2020-15900 Memory Corruption in Ghostscript 9.52

Fix the 'rsearch' calculation for the 'post' size to give the correct
size.  Previous calculation would result in a size that was too large,
and could underflow to max uint32_t. Also fix 'rsearch' to return the
correct 'pre' string with empty string match.

A future change may 'undefine' this undocumented, non-standard operator
during initialization as we do with the many other non-standard internal
PostScript operators and procedures.
Commit author: Ray Johnston

Vulnerable version (before fix):
 search_impl(i_ctx_t *i_ctx_p, bool forward)     return 0; found:     op->tas.type_attrs = op1->tas.type_attrs;     op->value.bytes = ptr;     r_set_size(op, size);     push(2);     op[-1] = *op1;     r_set_size(op - 1, ptr - op[-1].value.bytes);     op1->value.bytes = ptr + size;     r_set_size(op1, count + (!forward ? (size - 1) : 0));     make_true(op);     return 0; }

Fixed version (after fix):
 search_impl(i_ctx_t *i_ctx_p, bool forward)     return 0; found:     op->tas.type_attrs = op1->tas.type_attrs;     op->value.bytes = ptr;				/* match */     op->tas.rsize = size;				/* match */     push(2);     op[-1] = *op1;					/* pre */     op[-3].value.bytes = ptr + size;			/* post */     if (forward) {         op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */         op[-3].tas.rsize = count;			/* post */     } else {         op[-1].tas.rsize = count;			/* pre */         op[-3].tas.rsize -= count + size;		/* post */     }     make_true(op);     return 0; }

Patch:
patch: @@ -142,13 +142,18 @@ search_impl(i_ctx_t *i_ctx_p, bool forward)
     return 0;
 found:
     op->tas.type_attrs = op1->tas.type_attrs;
-    op->value.bytes = ptr;
-    r_set_size(op, size);
+    op->value.bytes = ptr;				/* match */
+    op->tas.rsize = size;				/* match */
     push(2);
-    op[-1] = *op1;
-    r_set_size(op - 1, ptr - op[-1].value.bytes);
-    op1->value.bytes = ptr + size;
-    r_set_size(op1, count + (!forward ? (size - 1) : 0));
+    op[-1] = *op1;					/* pre */
+    op[-3].value.bytes = ptr + size;			/* post */
+    if (forward) {
+        op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */
+        op[-3].tas.rsize = count;			/* post */
+    } else {
+        op[-1].tas.rsize = count;			/* pre */
+        op[-3].tas.rsize -= count + size;		/* post */
+    }
     make_true(op);
     return 0;
 }
path: psi/zstring.c