rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Division by zero in TFLite ### Impact 
An attacker can craft a TFLite model that would trigger a division by zero in [the implementation of depthwise convolutions](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/lite/kernels/depthwise_conv.cc#L96).

The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added before applying the convolution. There is no check before this division that the divisor is stricly positive.

### Patches              
We have patched the issue in GitHub commit [e5b0eec199c2d03de54fd6a7fd9275692218e2bc](https://github.com/tensorflow/tensorflow/commit/e5b0eec199c2d03de54fd6a7fd9275692218e2bc).
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Vulnerability ID: GHSA-428x-9xc2-m8mj
CWE: CWE-369
Severity score: 6.5
Project: https://github.com/tensorflow/tensorflow
Published: 2022-02-09
File: tensorflow/lite/kernels/depthwise_conv.cc
Commit message: [lite] Add validation check for dilation height/width to be positive integers.

PiperOrigin-RevId: 416429178
Change-Id: If7cdcddca54486434d9b2f06e7e2b401d7c3ee25
Commit author: Karim Nosir

Vulnerable version (before fix):
 TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {    TF_LITE_ENSURE_EQ(context, NumDimensions(input), 4);   TF_LITE_ENSURE_EQ(context, NumDimensions(filter), 4);    const TfLiteType data_type = input->type; 

Fixed version (after fix):
 TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {    TF_LITE_ENSURE_EQ(context, NumDimensions(input), 4);   TF_LITE_ENSURE_EQ(context, NumDimensions(filter), 4);   TF_LITE_ENSURE(context, params->dilation_height_factor > 0);   TF_LITE_ENSURE(context, params->dilation_width_factor > 0);    const TfLiteType data_type = input->type; 

Patch:
patch: @@ -115,6 +115,8 @@ TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {
 
   TF_LITE_ENSURE_EQ(context, NumDimensions(input), 4);
   TF_LITE_ENSURE_EQ(context, NumDimensions(filter), 4);
+  TF_LITE_ENSURE(context, params->dilation_height_factor > 0);
+  TF_LITE_ENSURE(context, params->dilation_width_factor > 0);
 
   const TfLiteType data_type = input->type;
path: tensorflow/lite/kernels/depthwise_conv.cc
Vulnerability: XSS due to lack of CSRF validation for replying/publishing ### Impact
Due to lack of CSRF validation, a logged in user is potentially vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum.

### Patches
Upgrade to the latest version v0.7.0

### Workarounds
You can cherry-pick the following commit: [https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618](https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618)

### References
Visit https://community.nodebb.org if you have any questions about this issue or on how to patch / upgrade your instance.
Vulnerability ID: GHSA-43m5-c88r-cjvv
CWE: CWE-352
Severity score: 6.8
Project: https://github.com/psychobunny/nodebb-plugin-blog-comments
Published: 2020-08-26
File: library.js
Commit message: fix: CSRF issues
Commit author: psychobunny

Vulnerable version (before fix):
 		});  		app.get('/comments/get/:id/:pagination?', middleware.applyCSRF, Comments.getCommentData); 		app.post('/comments/reply', Comments.replyToComment); 		app.post('/comments/publish', Comments.publishArticle);  		app.get('/admin/blog-comments', middleware.admin.buildHeader, renderAdmin); 		app.get('/api/admin/blog-comments', renderAdmin);

Fixed version (after fix):
 		});  		app.get('/comments/get/:id/:pagination?', middleware.applyCSRF, Comments.getCommentData); 		app.post('/comments/reply', middleware.applyCSRF, Comments.replyToComment); 		app.post('/comments/publish', middleware.applyCSRF, Comments.publishArticle);  		app.get('/admin/blog-comments', middleware.admin.buildHeader, renderAdmin); 		app.get('/api/admin/blog-comments', renderAdmin);

Patch:
patch: @@ -248,8 +248,8 @@
 		});
 
 		app.get('/comments/get/:id/:pagination?', middleware.applyCSRF, Comments.getCommentData);
-		app.post('/comments/reply', Comments.replyToComment);
-		app.post('/comments/publish', Comments.publishArticle);
+		app.post('/comments/reply', middleware.applyCSRF, Comments.replyToComment);
+		app.post('/comments/publish', middleware.applyCSRF, Comments.publishArticle);
 
 		app.get('/admin/blog-comments', middleware.admin.buildHeader, renderAdmin);
 		app.get('/api/admin/blog-comments', renderAdmin);
path: library.js
Vulnerability: Command injection in total.js There is a command injection vulnerability that affects the package total.js before version 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
Vulnerability ID: GHSA-4449-hg37-77v8
CWE: CWE-78
Severity score: 8.6
Project: https://github.com/totaljs/framework
Published: 2021-02-05
File: image.js
Commit message: Fixed "Command Injection" in `image.stream()` - thank to Sam Sanoop.
Commit author: Peter Sirka

Vulnerable version (before fix):
 const SPAWN_OPT = { shell: true }; const D = require('os').platform().substring(0, 3).toLowerCase() === 'win' ? '"' : '\''; const CMD_CONVERT = { gm: 'gm', im: 'convert', magick: 'magick' }; const CMD_CONVERT2 = { gm: 'gm convert', im: 'convert', magick: 'magick' };  var CACHE = {}; var middlewares = {}; ImageProto.stream = function(type, writer) {  	!self.builder.length && self.minify();  	if (!type) 		type = self.outputType;  	F.stats.performance.open++;

Fixed version (after fix):
 const SPAWN_OPT = { shell: true }; const D = require('os').platform().substring(0, 3).toLowerCase() === 'win' ? '"' : '\''; const CMD_CONVERT = { gm: 'gm', im: 'convert', magick: 'magick' }; const CMD_CONVERT2 = { gm: 'gm convert', im: 'convert', magick: 'magick' }; const SUPPORTEDIMAGES = { jpg: 1, png: 1, gif: 1, apng: 1, jpeg: 1, heif: 1, heic: 1, webp: 1, ico: 1 };  var CACHE = {}; var middlewares = {}; ImageProto.stream = function(type, writer) {  	!self.builder.length && self.minify();  	if (!type || !SUPPORTEDIMAGES[type]) 		type = self.outputType;  	F.stats.performance.open++;

Patch:
patch: @@ -38,6 +38,7 @@ const SPAWN_OPT = { shell: true };
 const D = require('os').platform().substring(0, 3).toLowerCase() === 'win' ? '"' : '\'';
 const CMD_CONVERT = { gm: 'gm', im: 'convert', magick: 'magick' };
 const CMD_CONVERT2 = { gm: 'gm convert', im: 'convert', magick: 'magick' };
+const SUPPORTEDIMAGES = { jpg: 1, png: 1, gif: 1, apng: 1, jpeg: 1, heif: 1, heic: 1, webp: 1, ico: 1 };
 
 var CACHE = {};
 var middlewares = {};
@@ -322,7 +323,7 @@ ImageProto.stream = function(type, writer) {
 
 	!self.builder.length && self.minify();
 
-	if (!type)
+	if (!type || !SUPPORTEDIMAGES[type])
 		type = self.outputType;
 
 	F.stats.performance.open++;
path: image.js
Vulnerability: Object injection in cookie driver in phpfastcache ### Impact
An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases).

### Patches
The issue has been addressed by enforcing JSON conversion when deserializing

### Workarounds
If you can't fix it, use another driver such as "Files" (Filesystem)

### References
Fixing release: https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issue tracker](https://github.com/PHPSocialNetwork/phpfastcache/issues)
* Email us at [security@geolim4.com](mailto:security@geolim4.com)
Vulnerability ID: GHSA-484f-743f-6jx2
CWE: CWE-94
Severity score: 4.4
Project: https://github.com/PHPSocialNetwork/phpfastcache
Published: 2019-12-12
File: src/phpFastCache/Drivers/Cookie/Driver.php
Commit message: Fixed critical vulnerability on cookie driver
Commit author: Geolim4

Vulnerable version (before fix):
 protected function driverRead(CacheItemInterface $item)         // return null if no caching         // return value if in caching         $keyword = self::PREFIX . $item->getKey();         $x = isset($_COOKIE[ $keyword ]) ? $this->decode(json_decode($_COOKIE[ $keyword ], true)) : false;          if ($x == false) {             return null;

Fixed version (after fix):
 protected function driverRead(CacheItemInterface $item)         // return null if no caching         // return value if in caching         $keyword = self::PREFIX . $item->getKey();         $x = isset($_COOKIE[ $keyword ]) ? json_decode($_COOKIE[ $keyword ], true) : false;          if ($x == false) {             return null;

Patch:
patch: @@ -99,7 +99,7 @@ protected function driverRead(CacheItemInterface $item)
         // return null if no caching
         // return value if in caching
         $keyword = self::PREFIX . $item->getKey();
-        $x = isset($_COOKIE[ $keyword ]) ? $this->decode(json_decode($_COOKIE[ $keyword ], true)) : false;
+        $x = isset($_COOKIE[ $keyword ]) ? json_decode($_COOKIE[ $keyword ], true) : false;
 
         if ($x == false) {
             return null;
path: src/phpFastCache/Drivers/Cookie/Driver.php
Vulnerability: JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> ### Impact

Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.

### Patches

Patched in the following versions: 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.21.

### References

[OWASP Page on Restricting Form Submissions](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.

Credit: Guillaume Jeanne from Google
Vulnerability ID: GHSA-4952-p58q-6crx
CWE: CWE-79
Severity score: 7.4
Project: https://github.com/jupyterlab/jupyterlab
Published: 2021-08-23
File: packages/apputils/src/sanitizer.ts
Commit message: Merge pull request from GHSA-4952-p58q-6crx

Remove `form` tags' `action` attribute during sanitizing.

Co-authored-by: Afshin Taylor Darian <git@darian.af>
Commit author: Steven Silvester

Vulnerable version (before fix):
 export class Sanitizer implements ISanitizer {       font: ['color', 'face', 'size'],       form: [         'accept',         'action',         'autocomplete',         'enctype',         'method',

Fixed version (after fix):
 export class Sanitizer implements ISanitizer {       font: ['color', 'face', 'size'],       form: [         'accept',         'autocomplete',         'enctype',         'method',

Patch:
patch: @@ -624,7 +624,6 @@ export class Sanitizer implements ISanitizer {
       font: ['color', 'face', 'size'],
       form: [
         'accept',
-        'action',
         'autocomplete',
         'enctype',
         'method',
path: packages/apputils/src/sanitizer.ts
Vulnerability: OS Command Injection in devcert-sanscache devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.
Vulnerability ID: GHSA-4gp3-p7ph-x2jr
CWE: CWE-78
Severity score: 9.8
Project: https://github.com/guybedford/devcert
Published: 2020-04-14
File: src/index.ts
Commit message: common name sanitization
Commit author: Guy Bedford

Vulnerable version (before fix):
 import fs = require('fs'); export default async function generateDevCert (commonName: string) {   if (!commandExists.sync('openssl'))     throw new Error('Unable to find openssl - make sure it is installed and available in your PATH');   if (!commonName.match(/^(.|\.){1,64}$/))     throw new Error(`Invalid Common Name ${commonName}.`);   try {     const opensslConfPath = generateOpensslConf(commonName);

Fixed version (after fix):
 import fs = require('fs'); export default async function generateDevCert (commonName: string) {   if (!commandExists.sync('openssl'))     throw new Error('Unable to find openssl - make sure it is installed and available in your PATH');   if (!commonName.match(/^(a-zA-Z0-9|\.){1,64}$/))     throw new Error(`Invalid Common Name ${commonName}.`);   try {     const opensslConfPath = generateOpensslConf(commonName);

Patch:
patch: @@ -6,7 +6,7 @@ import fs = require('fs');
 export default async function generateDevCert (commonName: string) {
   if (!commandExists.sync('openssl'))
     throw new Error('Unable to find openssl - make sure it is installed and available in your PATH');
-  if (!commonName.match(/^(.|\.){1,64}$/))
+  if (!commonName.match(/^(a-zA-Z0-9|\.){1,64}$/))
     throw new Error(`Invalid Common Name ${commonName}.`);
   try {
     const opensslConfPath = generateOpensslConf(commonName);
path: src/index.ts
Vulnerability: Regular expression denial of service in codemirror This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2.
 The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
Vulnerability ID: GHSA-4gw3-8f77-f72c
CWE: CWE-400
Severity score: 5.3
Project: https://github.com/codemirror/CodeMirror
Published: 2021-05-10
File: mode/javascript/javascript.js
Commit message: [javascript mode] Fix potentially-exponential regexp
Commit author: Marijn Haverbeke

Vulnerable version (before fix):
 CodeMirror.defineMode("javascript", function(config, parserConfig) {           var kw = keywords[word]           return ret(kw.type, kw.style, word)         }         if (word == "async" && stream.match(/^(\s|\/\*.*?\*\/)*[\[\(\w]/, false))           return ret("async", "keyword", word)       }       return ret("variable", "variable", word)

Fixed version (after fix):
 CodeMirror.defineMode("javascript", function(config, parserConfig) {           var kw = keywords[word]           return ret(kw.type, kw.style, word)         }         if (word == "async" && stream.match(/^(\s|\/\*([^*]|\*(?!\/))*?\*\/)*[\[\(\w]/, false))           return ret("async", "keyword", word)       }       return ret("variable", "variable", word)

Patch:
patch: @@ -126,7 +126,7 @@ CodeMirror.defineMode("javascript", function(config, parserConfig) {
           var kw = keywords[word]
           return ret(kw.type, kw.style, word)
         }
-        if (word == "async" && stream.match(/^(\s|\/\*.*?\*\/)*[\[\(\w]/, false))
+        if (word == "async" && stream.match(/^(\s|\/\*([^*]|\*(?!\/))*?\*\/)*[\[\(\w]/, false))
           return ret("async", "keyword", word)
       }
       return ret("variable", "variable", word)
path: mode/javascript/javascript.js
Vulnerability: Cross-site scripting in fat_free_crm Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
Vulnerability ID: GHSA-4p8f-mmfj-r45g
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/fatfreecrm/fat_free_crm
Published: 2019-08-21
File: app/helpers/tags_helper.rb
Commit message: Context-sensitive XSS bugfix.
Commit author: Antonin Steinhauser

Vulnerable version (before fix):
 def tags_for_index(model)       elsif !query.include?(hashtag)         query += " #{hashtag}"       end       out << link_to_function(tag, "crm.search_tagged('#{query}', '#{model.class.to_s.tableize}')", title: tag)     end   end 

Fixed version (after fix):
 def tags_for_index(model)       elsif !query.include?(hashtag)         query += " #{hashtag}"       end       out << link_to_function(tag, "crm.search_tagged('#{escape_javascript(query)}', '#{model.class.to_s.tableize}')", title: tag)     end   end 

Patch:
patch: @@ -17,7 +17,7 @@ def tags_for_index(model)
       elsif !query.include?(hashtag)
         query += " #{hashtag}"
       end
-      out << link_to_function(tag, "crm.search_tagged('#{query}', '#{model.class.to_s.tableize}')", title: tag)
+      out << link_to_function(tag, "crm.search_tagged('#{escape_javascript(query)}', '#{model.class.to_s.tableize}')", title: tag)
     end
   end
path: app/helpers/tags_helper.rb
Vulnerability: Division by zero in TFLite's implementation of `EmbeddingLookup` The implementation of the `EmbeddingLookup` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/e4b29809543b250bc9b19678ec4776299dd569ba/tensorflow/lite/kernels/embedding_lookup.cc#L73-L74):

```cc
const int row_size = SizeOfDimension(value, 0);
const int row_bytes = value->bytes / row_size;
```

An attacker can craft a model such that the first dimension of the `value` input is 0.

### Patches
We have patched the issue in GitHub commit [f61c57bd425878be108ec787f4d96390579fb83e](https://github.com/tensorflow/tensorflow/commit/f61c57bd425878be108ec787f4d96390579fb83e).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability ID: GHSA-4vrf-ff7v-hpgr
CWE: CWE-369
Severity score: 2.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-05-21
File: tensorflow/lite/kernels/embedding_lookup.cc
Commit message: Prevent division by 0

PiperOrigin-RevId: 370966645
Change-Id: I831bfd96c7eb77b02d7ebb744335f59f6e5728cb
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 TfLiteStatus EvalSimple(TfLiteContext* context, TfLiteNode* node,                         const TfLiteTensor* lookup, const TfLiteTensor* value,                         TfLiteTensor* output) {   const int row_size = SizeOfDimension(value, 0);   const int row_bytes = value->bytes / row_size;    char* output_raw = GetTensorData<char>(output);

Fixed version (after fix):
 TfLiteStatus EvalSimple(TfLiteContext* context, TfLiteNode* node,                         const TfLiteTensor* lookup, const TfLiteTensor* value,                         TfLiteTensor* output) {   const int row_size = SizeOfDimension(value, 0);   if (row_size == 0) {     // Propagate empty tensor if input is empty     return kTfLiteOk;   }   const int row_bytes = value->bytes / row_size;    char* output_raw = GetTensorData<char>(output);

Patch:
patch: @@ -71,6 +71,10 @@ TfLiteStatus EvalSimple(TfLiteContext* context, TfLiteNode* node,
                         const TfLiteTensor* lookup, const TfLiteTensor* value,
                         TfLiteTensor* output) {
   const int row_size = SizeOfDimension(value, 0);
+  if (row_size == 0) {
+    // Propagate empty tensor if input is empty
+    return kTfLiteOk;
+  }
   const int row_bytes = value->bytes / row_size;
 
   char* output_raw = GetTensorData<char>(output);
path: tensorflow/lite/kernels/embedding_lookup.cc
Vulnerability: Code injection in nobelprizeparser Code injection through use of eval.
Vulnerability ID: GHSA-4wv4-mgfq-598v
CWE: CWE-94
Severity score: 0
Project: https://github.com/AnneTheDev/nobelprize
Published: 2021-03-12
File: lib/index.js
Commit message: Merge pull request from GHSA-4wv4-mgfq-598v

Replace eval with JSON.parse
Commit author: AnneTheDev

Vulnerable version (before fix):
 function output(laureate) { class Parser {     // Parse JSON data     constructor(data) {         this.laureates = eval(`(${data})`).laureates;     }      inYear(year) {

Fixed version (after fix):
 function output(laureate) { class Parser {     // Parse JSON data     constructor(data) {         this.laureates = JSON.parse(data}).laureates;     }      inYear(year) {

Patch:
patch: @@ -10,7 +10,7 @@ function output(laureate) {
 class Parser {
     // Parse JSON data
     constructor(data) {
-        this.laureates = eval(`(${data})`).laureates;
+        this.laureates = JSON.parse(data}).laureates;
     }
 
     inYear(year) {
path: lib/index.js
Vulnerability: Cross-site Scripting in LiveHelperChat LiveHelperChat prior to version 3.93 contains a cross-site scripting vulnerability.
Vulnerability ID: GHSA-54qq-9chj-rxhv
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/livehelperchat/livehelperchat
Published: 2022-01-29
File: lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
Commit message: Escape in user box
Commit author: Remigijus Kiminas

Vulnerable version (before fix):
  ?> <li class="nav-item dropleft">     <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false"><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>     <div class="dropdown-menu" style="min-width: 25rem;" role="menu">          <div class="row">

Fixed version (after fix):
  ?> <li class="nav-item dropleft">     <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false" ng-non-bindable><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>     <div class="dropdown-menu" style="min-width: 25rem;" role="menu">          <div class="row">

Patch:
patch: @@ -12,7 +12,7 @@
 
 ?>
 <li class="nav-item dropleft">
-    <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false"><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>
+    <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false" ng-non-bindable><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>
     <div class="dropdown-menu" style="min-width: 25rem;" role="menu">
 
         <div class="row">
path: lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php