rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: react-dev-utils OS Command Injection in function `getProcessForPort` react-dev-utils prior to v11.0.4 exposes a function, `getProcessForPort`, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Vulnerability ID: GHSA-5q6m-3h65-w53x
CWE: CWE-78
Severity score: 5.6
Project: https://github.com/facebook/create-react-app
Published: 2021-03-11
File: packages/react-dev-utils/getProcessForPort.js
Commit message: Security Fix for Command Injection - huntr.dev (#10644)

* Update getProcessForPort.js

* Update getProcessForPort.js

Co-authored-by: Zhou Peng <zpbrent@gmail.com>
Co-authored-by: Dan Abramov <dan.abramov@gmail.com>
Commit author: huntr.dev | the place to protect open source

Vulnerable version (before fix):
  var chalk = require('chalk'); var execSync = require('child_process').execSync; var path = require('path');  var execOptions = { function isProcessAReactApp(processCommand) { }  function getProcessIdOnPort(port) {   return execSync('lsof -i:' + port + ' -P -t -sTCP:LISTEN', execOptions)     .split('\n')[0]     .trim(); }

Fixed version (after fix):
  var chalk = require('chalk'); var execSync = require('child_process').execSync; var execFileSync = require('child_process').execFileSync; var path = require('path');  var execOptions = { function isProcessAReactApp(processCommand) { }  function getProcessIdOnPort(port) {   return execFileSync('lsof', ['-i:' + port, '-P', '-t', '-sTCP:LISTEN'], execOptions)     .split('\n')[0]     .trim(); }

Patch:
patch: @@ -9,6 +9,7 @@
 
 var chalk = require('chalk');
 var execSync = require('child_process').execSync;
+var execFileSync = require('child_process').execFileSync;
 var path = require('path');
 
 var execOptions = {
@@ -25,7 +26,7 @@ function isProcessAReactApp(processCommand) {
 }
 
 function getProcessIdOnPort(port) {
-  return execSync('lsof -i:' + port + ' -P -t -sTCP:LISTEN', execOptions)
+  return execFileSync('lsof', ['-i:' + port, '-P', '-t', '-sTCP:LISTEN'], execOptions)
     .split('\n')[0]
     .trim();
 }
path: packages/react-dev-utils/getProcessForPort.js
Vulnerability: Cross-site Scripting in LibreNMS LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.
Vulnerability ID: GHSA-5vr6-hm68-5j9p
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/librenms/librenms
Published: 2021-12-03
File: includes/html/forms/poller-groups.inc.php
Commit message: fix XSS vulnerability in poller-groups.inc.php
Commit author: AL-KASSAR

Vulnerable version (before fix):
 if (! empty($ok)) {     exit("$ok"); } else {     exit("ERROR: $error"); }

Fixed version (after fix):
 if (! empty($ok)) {     exit("$ok"); } else {     exit("ERROR: ".htmlspecialchars($error));; }

Patch:
patch: @@ -44,5 +44,5 @@
 if (! empty($ok)) {
     exit("$ok");
 } else {
-    exit("ERROR: $error");
+    exit("ERROR: ".htmlspecialchars($error));;
 }
path: includes/html/forms/poller-groups.inc.php
Vulnerability: Cross site-scripting (XSS) moodle The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
Vulnerability ID: GHSA-5x33-h32w-6vr2
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/moodle/moodle
Published: 2021-03-29
File: tag/manage.php
Commit message: MDL-69340 tag: Correct the filter input HTML in the tag manager
Commit author: Michael Hawkins

Vulnerable version (before fix):
 print('<div class="tag-management-form generalbox"><label class="accesshide" for="id_tagfilter">'. get_string('search') .'</label>'.     '<input type="hidden" name="tc" value="'.$tagcollid.'" />'.     '<input type="hidden" name="perpage" value="'.$perpage.'" />'.     '<input id="id_tagfilter" name="filter" type="text" value=' . s($filter) . '>'.     '<input value="'. s(get_string('search')) .'" type="submit" class="btn btn-secondary"> '.     ($filter !== '' ? html_writer::link(new moodle_url($PAGE->url, array('filter' => null)),         get_string('resetfilter', 'tag'), array('class' => 'resetfilterlink')) : '').

Fixed version (after fix):
 print('<div class="tag-management-form generalbox"><label class="accesshide" for="id_tagfilter">'. get_string('search') .'</label>'.     '<input type="hidden" name="tc" value="'.$tagcollid.'" />'.     '<input type="hidden" name="perpage" value="'.$perpage.'" />'.     '<input id="id_tagfilter" name="filter" type="text" value="' . s($filter) . '">'.     '<input value="'. s(get_string('search')) .'" type="submit" class="btn btn-secondary"> '.     ($filter !== '' ? html_writer::link(new moodle_url($PAGE->url, array('filter' => null)),         get_string('resetfilter', 'tag'), array('class' => 'resetfilterlink')) : '').

Patch:
patch: @@ -211,7 +211,7 @@
 print('<div class="tag-management-form generalbox"><label class="accesshide" for="id_tagfilter">'. get_string('search') .'</label>'.
     '<input type="hidden" name="tc" value="'.$tagcollid.'" />'.
     '<input type="hidden" name="perpage" value="'.$perpage.'" />'.
-    '<input id="id_tagfilter" name="filter" type="text" value=' . s($filter) . '>'.
+    '<input id="id_tagfilter" name="filter" type="text" value="' . s($filter) . '">'.
     '<input value="'. s(get_string('search')) .'" type="submit" class="btn btn-secondary"> '.
     ($filter !== '' ? html_writer::link(new moodle_url($PAGE->url, array('filter' => null)),
         get_string('resetfilter', 'tag'), array('class' => 'resetfilterlink')) : '').
path: tag/manage.php
Vulnerability: Microweber vulnerable to cross-site scripting (XSS) Microweber is a drag and drop website builder and a powerful next generation CMS. Microweber versions 1.2.15 and prior are vulnerable to cross-site scripting. This could lead to injection of arbitrary JaveScript code, defacement of a page, or stealing cookies. A patch is available on the `master` branch of Microweber's GitHub repository.
Vulnerability ID: GHSA-6346-5r4h-ff5x
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/microweber/microweber
Published: 2022-05-05
File: src/MicroweberPackages/Order/resources/views/admin/orders/partials/order_filtering.blade.php
Commit message: Update order_filtering.blade.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 class="btn btn-link btn-sm <?php if (isset($abandoned)): ?>font-weight-bold text             $(document).ready(function () {                 var searchOrdersByProduct = new mw.autoComplete({                     element: "#js-orders-search-by-products",                     placeholder: "<?php if ($productKeyword) { echo $productKeyword; } else { _e("Search by products..."); }?>",                     autoComplete:true,                     ajaxConfig: {                         method: 'get',

Fixed version (after fix):
 class="btn btn-link btn-sm <?php if (isset($abandoned)): ?>font-weight-bold text             $(document).ready(function () {                 var searchOrdersByProduct = new mw.autoComplete({                     element: "#js-orders-search-by-products",                     placeholder: "<?php if ($productKeyword) { echo xss_clean($productKeyword); } else { _e("Search by products..."); }?>",                     autoComplete:true,                     ajaxConfig: {                         method: 'get',

Patch:
patch: @@ -158,7 +158,7 @@ class="btn btn-link btn-sm <?php if (isset($abandoned)): ?>font-weight-bold text
             $(document).ready(function () {
                 var searchOrdersByProduct = new mw.autoComplete({
                     element: "#js-orders-search-by-products",
-                    placeholder: "<?php if ($productKeyword) { echo $productKeyword; } else { _e("Search by products..."); }?>",
+                    placeholder: "<?php if ($productKeyword) { echo xss_clean($productKeyword); } else { _e("Search by products..."); }?>",
                     autoComplete:true,
                     ajaxConfig: {
                         method: 'get',
path: src/MicroweberPackages/Order/resources/views/admin/orders/partials/order_filtering.blade.php
Vulnerability: Regular Expression Denial of Service in ua-parser-js The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
Vulnerability ID: GHSA-662x-fhqg-9p8v
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/faisalman/ua-parser-js
Published: 2021-05-07
File: src/ua-parser.js
Commit message: Fix potential ReDoS vulnerability
Commit author: Faisal Salman

Vulnerable version (before fix):
             /android.+(hm[\s\-_]*note?[\s_]*(?:\d\w)?)\s+build/i,               // Xiaomi Hongmi             /android.+(mi[\s\-_]*(?:a\d|one|one[\s_]plus|note lte)?[\s_]*(?:\d?\w?)[\s_]*(?:plus)?)\s+build/i,                                                                                     // Xiaomi Mi             /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]*[\w\s]+))\s+build/i       // Redmi Phones             ], [[MODEL, /_/g, ' '], [VENDOR, 'Xiaomi'], [TYPE, MOBILE]], [             /android.+(mi[\s\-_]*(?:pad)(?:[\s_]*[\w\s]+))\s+build/i            // Mi Pad tablets             ],[[MODEL, /_/g, ' '], [VENDOR, 'Xiaomi'], [TYPE, TABLET]], [             /android.+;\s(m[1-5]\snote)\sbuild/i                                // Meizu             ], [MODEL, [VENDOR, 'Meizu'], [TYPE, MOBILE]], [

Fixed version (after fix):
             /android.+(hm[\s\-_]*note?[\s_]*(?:\d\w)?)\s+build/i,               // Xiaomi Hongmi             /android.+(mi[\s\-_]*(?:a\d|one|one[\s_]plus|note lte)?[\s_]*(?:\d?\w?)[\s_]*(?:plus)?)\s+build/i,                                                                                     // Xiaomi Mi             /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]?[\w\s]+))\s+build/i       // Redmi Phones             ], [[MODEL, /_/g, ' '], [VENDOR, 'Xiaomi'], [TYPE, MOBILE]], [             /android.+(mi[\s\-_]*(?:pad)(?:[\s_]?[\w\s]+))\s+build/i            // Mi Pad tablets             ],[[MODEL, /_/g, ' '], [VENDOR, 'Xiaomi'], [TYPE, TABLET]], [             /android.+;\s(m[1-5]\snote)\sbuild/i                                // Meizu             ], [MODEL, [VENDOR, 'Meizu'], [TYPE, MOBILE]], [

Patch:
patch: @@ -585,9 +585,9 @@
             /android.+(hm[\s\-_]*note?[\s_]*(?:\d\w)?)\s+build/i,               // Xiaomi Hongmi
             /android.+(mi[\s\-_]*(?:a\d|one|one[\s_]plus|note lte)?[\s_]*(?:\d?\w?)[\s_]*(?:plus)?)\s+build/i,    
                                                                                 // Xiaomi Mi
-            /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]*[\w\s]+))\s+build/i       // Redmi Phones
+            /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]?[\w\s]+))\s+build/i       // Redmi Phones
             ], [[MODEL, /_/g, ' '], [VENDOR, 'Xiaomi'], [TYPE, MOBILE]], [
-            /android.+(mi[\s\-_]*(?:pad)(?:[\s_]*[\w\s]+))\s+build/i            // Mi Pad tablets
+            /android.+(mi[\s\-_]*(?:pad)(?:[\s_]?[\w\s]+))\s+build/i            // Mi Pad tablets
             ],[[MODEL, /_/g, ' '], [VENDOR, 'Xiaomi'], [TYPE, TABLET]], [
             /android.+;\s(m[1-5]\snote)\sbuild/i                                // Meizu
             ], [MODEL, [VENDOR, 'Meizu'], [TYPE, MOBILE]], [
path: src/ua-parser.js
Vulnerability: Data races in rcu_cell Affected versions of this crate unconditionally implement Send/Sync for `RcuCell<T>`.
This allows users to send `T: !Send` to other threads (while `T` enclosed within `RcuCell<T>`), and allows users to concurrently access `T: !Sync` by using the APIs of `RcuCell<T>` that provide access to `&T`.

This can result in memory corruption caused by data races.
Vulnerability ID: GHSA-686h-j8r8-wmfm
CWE: CWE-362
Severity score: 8.1
Project: https://github.com/Xudong-Huang/rcu_cell
Published: 2021-08-25
File: src/lib.rs
Commit message: Fix Send/Sync impl of RcuCell<T>
Commit author: JOE1994

Vulnerable version (before fix):
 pub struct RcuCell<T> {     link: LinkWrapper<T>, }  unsafe impl<T> Send for RcuCell<T> {} unsafe impl<T> Sync for RcuCell<T> {}  impl<T> Default for RcuCell<T> {     fn default() -> Self {

Fixed version (after fix):
 pub struct RcuCell<T> {     link: LinkWrapper<T>, }  unsafe impl<T: Send> Send for RcuCell<T> {} unsafe impl<T: Sync> Sync for RcuCell<T> {}  impl<T> Default for RcuCell<T> {     fn default() -> Self {

Patch:
patch: @@ -372,8 +372,8 @@ pub struct RcuCell<T> {
     link: LinkWrapper<T>,
 }
 
-unsafe impl<T> Send for RcuCell<T> {}
-unsafe impl<T> Sync for RcuCell<T> {}
+unsafe impl<T: Send> Send for RcuCell<T> {}
+unsafe impl<T: Sync> Sync for RcuCell<T> {}
 
 impl<T> Default for RcuCell<T> {
     fn default() -> Self {
path: src/lib.rs
Vulnerability: SQL injection in moodle A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
Vulnerability ID: GHSA-69c3-5xxf-58q2
CWE: CWE-89
Severity score: 9.8
Project: https://github.com/moodle/moodle
Published: 2022-05-19
File: badges/criteria/award_criteria_profile.php
Commit message: MDL-74333 badges: Check profile criteria valid when reviewing
Commit author: Michael Hawkins

Vulnerable version (before fix):
 public function review($userid, $filtered = false) {                 $join .= " LEFT JOIN {user_info_data} uid{$idx} ON uid{$idx}.userid = u.id AND uid{$idx}.fieldid = :fieldid{$idx} ";                 $sqlparams["fieldid{$idx}"] = $param['field'];                 $whereparts[] = "uid{$idx}.id IS NOT NULL";             } else {                 // This is a field from {user} table.                 if ($param['field'] == 'picture') {                     // The picture field is numeric and requires special handling.                     $whereparts[] = "u.{$param['field']} != 0";

Fixed version (after fix):
 public function review($userid, $filtered = false) {                 $join .= " LEFT JOIN {user_info_data} uid{$idx} ON uid{$idx}.userid = u.id AND uid{$idx}.fieldid = :fieldid{$idx} ";                 $sqlparams["fieldid{$idx}"] = $param['field'];                 $whereparts[] = "uid{$idx}.id IS NOT NULL";             } else if (in_array($param['field'], $this->allowed_default_fields)) {                 // This is a valid field from {user} table.                 if ($param['field'] == 'picture') {                     // The picture field is numeric and requires special handling.                     $whereparts[] = "u.{$param['field']} != 0";

Patch:
patch: @@ -202,8 +202,8 @@ public function review($userid, $filtered = false) {
                 $join .= " LEFT JOIN {user_info_data} uid{$idx} ON uid{$idx}.userid = u.id AND uid{$idx}.fieldid = :fieldid{$idx} ";
                 $sqlparams["fieldid{$idx}"] = $param['field'];
                 $whereparts[] = "uid{$idx}.id IS NOT NULL";
-            } else {
-                // This is a field from {user} table.
+            } else if (in_array($param['field'], $this->allowed_default_fields)) {
+                // This is a valid field from {user} table.
                 if ($param['field'] == 'picture') {
                     // The picture field is numeric and requires special handling.
                     $whereparts[] = "u.{$param['field']} != 0";
path: badges/criteria/award_criteria_profile.php
Vulnerability: Prototype pollution in total.js There is a prototype pollution vulnerability in the package total.js before version 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
Vulnerability ID: GHSA-6cf8-qhqj-vjqm
CWE: CWE-400
Severity score: 0
Project: https://github.com/totaljs/framework
Published: 2021-02-05
File: utils.js
Commit message: Fixed `U.set()` by adding check for `Prototype pollution`.
Commit author: Peter Sirka

Vulnerable version (before fix):
 exports.set = function(obj, path, value) { 	var v = arr[arr.length - 1]; 	var ispush = v.lastIndexOf('[]') !== -1; 	var a = builder.join(';') + ';var v=typeof(a)===\'function\'?a(U.get(b)):a;w' + (v[0] === '[' ? '' : '.') + (ispush ? v.replace(REGREPLACEARR, '.push(v)') : (v + '=v')) + ';return v'; 	var fn = new Function('w', 'a', 'b', a); 	F.temporary.other[cachekey] = fn; 	fn(obj, value, path);

Fixed version (after fix):
 exports.set = function(obj, path, value) { 	var v = arr[arr.length - 1]; 	var ispush = v.lastIndexOf('[]') !== -1; 	var a = builder.join(';') + ';var v=typeof(a)===\'function\'?a(U.get(b)):a;w' + (v[0] === '[' ? '' : '.') + (ispush ? v.replace(REGREPLACEARR, '.push(v)') : (v + '=v')) + ';return v';  	if ((/__proto__|constructor|prototype/).test(a)) 		throw new Error('Prototype pollution');  	var fn = new Function('w', 'a', 'b', a); 	F.temporary.other[cachekey] = fn; 	fn(obj, value, path);

Patch:
patch: @@ -6621,6 +6621,10 @@ exports.set = function(obj, path, value) {
 	var v = arr[arr.length - 1];
 	var ispush = v.lastIndexOf('[]') !== -1;
 	var a = builder.join(';') + ';var v=typeof(a)===\'function\'?a(U.get(b)):a;w' + (v[0] === '[' ? '' : '.') + (ispush ? v.replace(REGREPLACEARR, '.push(v)') : (v + '=v')) + ';return v';
+
+	if ((/__proto__|constructor|prototype/).test(a))
+		throw new Error('Prototype pollution');
+
 	var fn = new Function('w', 'a', 'b', a);
 	F.temporary.other[cachekey] = fn;
 	fn(obj, value, path);
path: utils.js
Vulnerability: SQL Injection in Pimcore Pimcore prior to version 10.3.5 is vulnerable SQL injection in RecyclebinController.php. This vulnerability affects data confidentiality.
Vulnerability ID: GHSA-6gm7-j668-w6h9
CWE: CWE-89
Severity score: 7.5
Project: https://github.com/pimcore/pimcore
Published: 2022-04-09
File: bundles/AdminBundle/Controller/Admin/RecyclebinController.php
Commit message: [Recyclebin] Quote condition filter
Commit author: dpahuja

Vulnerable version (before fix):
 public function listAction(Request $request)                         $condition = $field . ' BETWEEN ' . $db->quote($value) . ' AND ' . $db->quote($maxTime);                         $conditionFilters[] = $condition;                     } else {                         $conditionFilters[] = $field . $operator . " '" . $value . "' ";                     }                 }             }

Fixed version (after fix):
 public function listAction(Request $request)                         $condition = $field . ' BETWEEN ' . $db->quote($value) . ' AND ' . $db->quote($maxTime);                         $conditionFilters[] = $condition;                     } else {                         $conditionFilters[] = $field . $operator . ' ' . $db->quote($value);                     }                 }             }

Patch:
patch: @@ -119,7 +119,7 @@ public function listAction(Request $request)
                         $condition = $field . ' BETWEEN ' . $db->quote($value) . ' AND ' . $db->quote($maxTime);
                         $conditionFilters[] = $condition;
                     } else {
-                        $conditionFilters[] = $field . $operator . " '" . $value . "' ";
+                        $conditionFilters[] = $field . $operator . ' ' . $db->quote($value);
                     }
                 }
             }
path: bundles/AdminBundle/Controller/Admin/RecyclebinController.php
Vulnerability: Cross-Site Request Forgery (CSRF) in livehelperchat A CSRF issue is found in the audit configuration under settings. It was found that no CSRF token validation is getting done on the server-side. If we remove the CSRF token and keep the CSRF token field empty, the action is getting performed.
Vulnerability ID: GHSA-6jmh-9gqm-5xrx
CWE: CWE-352
Severity score: 4.3
Project: https://github.com/livehelperchat/livehelperchat
Published: 2022-01-26
File: lhc_web/modules/lhaudit/configuration.php
Commit message: Missing csfr check
Commit author: Remigijus Kiminas

Vulnerable version (before fix):
  if ( isset($_POST['StoreOptions']) ) {      $definition = array(         'days_log' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'int'),         'log_js' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'boolean'),

Fixed version (after fix):
  if ( isset($_POST['StoreOptions']) ) {      if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {         erLhcoreClassModule::redirect();         exit;     }          $definition = array(         'days_log' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'int'),         'log_js' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'boolean'),

Patch:
patch: @@ -7,6 +7,11 @@
 
 if ( isset($_POST['StoreOptions']) ) {
 
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect();
+        exit;
+    }
+    
     $definition = array(
         'days_log' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'int'),
         'log_js' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'boolean'),
path: lhc_web/modules/lhaudit/configuration.php