rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Arbitrary shell command execution in logkitty Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.
Vulnerability ID: GHSA-v8v8-6859-qxm4
CWE: CWE-94
Severity score: 0
Project: https://github.com/zamotany/logkitty
Published: 2020-06-05
File: src/android/adb.ts
Commit message: huntr - Command Injection Fix (#18)

Co-authored-by: jammy <jammy@loves.shib.es>
Co-authored-by: Paweł Trysła <zamotany@users.noreply.github.com>
Commit author: huntr-helper

Vulnerable version (before fix):
 import { spawn, execSync, ChildProcess } from 'child_process'; import path from 'path'; import {   CodeError, export function getAdbPath(customPath?: string): string {  export function spawnLogcatProcess(adbPath: string): ChildProcess {   try {     execSync(`${adbPath} logcat -c`);   } catch (error) {     throw new CodeError(       ERR_ANDROID_CANNOT_CLEAN_LOGCAT_BUFFER, export function getApplicationPid(   applicationId: string,   adbPath?: string ): number {   let output: Buffer | undefined;   try {     output = execSync(       `'${getAdbPath(adbPath)}' shell pidof -s ${applicationId}`     );   } catch (error) {     throw new CodeError(       ERR_ANDROID_CANNOT_GET_APP_PID,

Fixed version (after fix):
 import { spawn, execFileSync, ChildProcess } from 'child_process'; import path from 'path'; import {   CodeError, export function getAdbPath(customPath?: string): string {  export function spawnLogcatProcess(adbPath: string): ChildProcess {   try {     execFileSync(adbPath, ['logcat', '-c']);   } catch (error) {     throw new CodeError(       ERR_ANDROID_CANNOT_CLEAN_LOGCAT_BUFFER, export function getApplicationPid(   applicationId: string,   adbPath?: string ): number {   let output: Buffer | String | undefined;   try {     output = execFileSync(getAdbPath(adbPath), [       'shell',       'pidof',       '-s',       applicationId,     ]);   } catch (error) {     throw new CodeError(       ERR_ANDROID_CANNOT_GET_APP_PID,

Patch:
patch: @@ -1,4 +1,4 @@
-import { spawn, execSync, ChildProcess } from 'child_process';
+import { spawn, execFileSync, ChildProcess } from 'child_process';
 import path from 'path';
 import {
   CodeError,
@@ -25,7 +25,7 @@ export function getAdbPath(customPath?: string): string {
 
 export function spawnLogcatProcess(adbPath: string): ChildProcess {
   try {
-    execSync(`${adbPath} logcat -c`);
+    execFileSync(adbPath, ['logcat', '-c']);
   } catch (error) {
     throw new CodeError(
       ERR_ANDROID_CANNOT_CLEAN_LOGCAT_BUFFER,
@@ -49,11 +49,14 @@ export function getApplicationPid(
   applicationId: string,
   adbPath?: string
 ): number {
-  let output: Buffer | undefined;
+  let output: Buffer | String | undefined;
   try {
-    output = execSync(
-      `'${getAdbPath(adbPath)}' shell pidof -s ${applicationId}`
-    );
+    output = execFileSync(getAdbPath(adbPath), [
+      'shell',
+      'pidof',
+      '-s',
+      applicationId,
+    ]);
   } catch (error) {
     throw new CodeError(
       ERR_ANDROID_CANNOT_GET_APP_PID,
path: src/android/adb.ts
Vulnerability: Denial of Service in Bytom In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash.
Vulnerability ID: GHSA-vc3x-gx6c-g99f
CWE: CWE-190
Severity score: 7.5
Project: https://github.com/Bytom/bytom
Published: 2022-02-15
File: p2p/discover/net.go
Commit message: p2p/discv5: fix idx can be negative after uint convert to int(can cause crash) (#1307)
Commit author: yahtoo

Vulnerable version (before fix):
 func (net *Network) checkTopicRegister(data *topicRegister) (*pong, error) { 	if hash != pongpkt.data.(*pong).TopicHash { 		return nil, errors.New("topic hash mismatch") 	} 	if data.Idx < 0 || int(data.Idx) >= len(data.Topics) { 		return nil, errors.New("topic index out of range") 	} 	return pongpkt.data.(*pong), nil

Fixed version (after fix):
 func (net *Network) checkTopicRegister(data *topicRegister) (*pong, error) { 	if hash != pongpkt.data.(*pong).TopicHash { 		return nil, errors.New("topic hash mismatch") 	} 	if int(data.Idx) < 0 || int(data.Idx) >= len(data.Topics) { 		return nil, errors.New("topic index out of range") 	} 	return pongpkt.data.(*pong), nil

Patch:
patch: @@ -1221,7 +1221,7 @@ func (net *Network) checkTopicRegister(data *topicRegister) (*pong, error) {
 	if hash != pongpkt.data.(*pong).TopicHash {
 		return nil, errors.New("topic hash mismatch")
 	}
-	if data.Idx < 0 || int(data.Idx) >= len(data.Topics) {
+	if int(data.Idx) < 0 || int(data.Idx) >= len(data.Topics) {
 		return nil, errors.New("topic index out of range")
 	}
 	return pongpkt.data.(*pong), nil
path: p2p/discover/net.go
Vulnerability: Cross-site Scripting in Pimcore Datahub Pimcore Datahub prior to 1.2.4 is vulnerable to stored cross-site scripting. An admin user accessing Datahub triggers the attack, which may result in the user's cookie being stolen.
Vulnerability ID: GHSA-vc5r-xfc4-4x22
CWE: CWE-79
Severity score: 4.8
Project: https://github.com/pimcore/data-hub
Published: 2022-03-25
File: src/Controller/ConfigController.php
Commit message: follow up to https://github.com/pimcore/data-hub/pull/462
Commit author: dpahuja

Vulnerable version (before fix):
 private function buildItem($configuration): array          return [             'id' => $name,             'text' => $name,             'type' => 'config',             'iconCls' => 'plugin_pimcore_datahub_icon_' . $type,             'expandable' => false,

Fixed version (after fix):
 private function buildItem($configuration): array          return [             'id' => $name,             'text' => htmlspecialchars($name),             'type' => 'config',             'iconCls' => 'plugin_pimcore_datahub_icon_' . $type,             'expandable' => false,

Patch:
patch: @@ -50,7 +50,7 @@ private function buildItem($configuration): array
 
         return [
             'id' => $name,
-            'text' => $name,
+            'text' => htmlspecialchars($name),
             'type' => 'config',
             'iconCls' => 'plugin_pimcore_datahub_icon_' . $type,
             'expandable' => false,
path: src/Controller/ConfigController.php
Vulnerability: Cross site scripting attack in ServiceStack Framework ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.
Vulnerability ID: GHSA-vcfc-9wcp-j623
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/ServiceStack/ServiceStack
Published: 2022-05-24
File: src/ServiceStack/Formats/HtmlFormat.cs
Commit message: HtmlEncode Raw URL in HtmlFormat snapshot
Commit author: Demis Bellot

Vulnerable version (before fix):
 public async Task SerializeToStreamAsync(IRequest req, object response, Stream o             {                 // Serialize then escape any potential script tags to avoid XSS when displaying as HTML                 var json = JsonDataContractSerializer.Instance.SerializeToString(dto) ?? "null";                 json = json.Replace("<", "&lt;").Replace(">", "&gt;");                  var url = req.ResolveAbsoluteUrl()                     .Replace("format=html", "")                     .Replace("format=shtm", "")                     .TrimEnd('?', '&');                  url += url.Contains("?") ? "&" : "?"; 

Fixed version (after fix):
 public async Task SerializeToStreamAsync(IRequest req, object response, Stream o             {                 // Serialize then escape any potential script tags to avoid XSS when displaying as HTML                 var json = JsonDataContractSerializer.Instance.SerializeToString(dto) ?? "null";                 json = json.HtmlEncode();                  var url = req.ResolveAbsoluteUrl()                     .Replace("format=html", "")                     .Replace("format=shtm", "")                     .TrimEnd('?', '&')                     .HtmlEncode();                  url += url.Contains("?") ? "&" : "?"; 

Patch:
patch: @@ -90,12 +90,13 @@ public async Task SerializeToStreamAsync(IRequest req, object response, Stream o
             {
                 // Serialize then escape any potential script tags to avoid XSS when displaying as HTML
                 var json = JsonDataContractSerializer.Instance.SerializeToString(dto) ?? "null";
-                json = json.Replace("<", "&lt;").Replace(">", "&gt;");
+                json = json.HtmlEncode();
 
                 var url = req.ResolveAbsoluteUrl()
                     .Replace("format=html", "")
                     .Replace("format=shtm", "")
-                    .TrimEnd('?', '&');
+                    .TrimEnd('?', '&')
+                    .HtmlEncode();
 
                 url += url.Contains("?") ? "&" : "?";
path: src/ServiceStack/Formats/HtmlFormat.cs
Vulnerability: Division by zero in TFLite's implementation of `TransposeConv` ### Impact
The optimized implementation of the `TransposeConv` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L5221-L5222):

```cc 
int height_col = (height + pad_t + pad_b - filter_h) / stride_h + 1;
int width_col = (width + pad_l + pad_r - filter_w) / stride_w + 1;
```

An attacker can craft a model such that `stride_{h,w}` values are 0. Code calling this function must validate these arguments.

### Patches
We have patched the issue in GitHub commit [801c1c6be5324219689c98e1bd3e0ca365ee834d](https://github.com/tensorflow/tensorflow/commit/801c1c6be5324219689c98e1bd3e0ca365ee834d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability ID: GHSA-vfr4-x8j2-3rf9
CWE: CWE-369
Severity score: 2.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-05-21
File: tensorflow/lite/kernels/transpose_conv.cc
Commit message: Fix another division by 0 in TFLite

PiperOrigin-RevId: 370800181
Change-Id: I924809166a6131f5075e6d45c455106538d755f9
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 TfLiteStatus Eval(TfLiteContext* context, TfLiteNode* node) {   const auto* params =       reinterpret_cast<TfLiteTransposeConvParams*>(node->builtin_data);    // Resize any deferred dynamic tensors   if (IsDynamicTensor(output)) {     TF_LITE_ENSURE_OK(context, ResizeTensor(context, output_shape, output));

Fixed version (after fix):
 TfLiteStatus Eval(TfLiteContext* context, TfLiteNode* node) {   const auto* params =       reinterpret_cast<TfLiteTransposeConvParams*>(node->builtin_data);    // Prevent divisions by 0   TF_LITE_ENSURE(context, params->stride_height > 0);   TF_LITE_ENSURE(context, params->stride_width > 0);    // Resize any deferred dynamic tensors   if (IsDynamicTensor(output)) {     TF_LITE_ENSURE_OK(context, ResizeTensor(context, output_shape, output));

Patch:
patch: @@ -591,6 +591,10 @@ TfLiteStatus Eval(TfLiteContext* context, TfLiteNode* node) {
   const auto* params =
       reinterpret_cast<TfLiteTransposeConvParams*>(node->builtin_data);
 
+  // Prevent divisions by 0
+  TF_LITE_ENSURE(context, params->stride_height > 0);
+  TF_LITE_ENSURE(context, params->stride_width > 0);
+
   // Resize any deferred dynamic tensors
   if (IsDynamicTensor(output)) {
     TF_LITE_ENSURE_OK(context, ResizeTensor(context, output_shape, output));
path: tensorflow/lite/kernels/transpose_conv.cc
Vulnerability: Cross-site Scripting in django-helpdesk django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: GHSA-vfrc-ggmc-5jwv
CWE: CWE-79
Severity score: 8.8
Project: https://github.com/django-helpdesk/django-helpdesk
Published: 2021-11-23
File: helpdesk/lib.py
Commit message: Add `att.full_clean()` before saving

Fix issue https://github.com/django-helpdesk/django-helpdesk/issues/983
Also, fix bug stored XSS disclosure: https://huntr.dev/bounties/4d7a5fdd-b2de-467a-ade0-3f2fb386638e/
Commit author: lethanhphuc

Vulnerable version (before fix):
 def process_attachments(followup, attached_files):                 'application/octet-stream',                 size=attached.size,             )             att.save()              if attached.size < max_email_attachment_size:

Fixed version (after fix):
 def process_attachments(followup, attached_files):                 'application/octet-stream',                 size=attached.size,             )             att.full_clean()             att.save()              if attached.size < max_email_attachment_size:

Patch:
patch: @@ -145,6 +145,7 @@ def process_attachments(followup, attached_files):
                 'application/octet-stream',
                 size=attached.size,
             )
+            att.full_clean()
             att.save()
 
             if attached.size < max_email_attachment_size:
path: helpdesk/lib.py
Vulnerability: Cross site scripting in LibreNMS LibreNMS prior to version 22.2.2 is vulnerable to cross-site scripting.
Vulnerability ID: GHSA-vhm6-gw82-6f8j
CWE: CWE-79
Severity score: 4.8
Project: https://github.com/librenms/librenms
Published: 2022-02-28
File: includes/html/modal/alert_rule_list.inc.php
Commit message: Resolved XSS issue from alert rule list modal (#13805)
Commit author: Neil Lathwood

Vulnerable version (before fix):
                             echo "                                 <tr>                                     <td>{$rule['name']}</td>                                     <td><i>" . htmlentities($rule_display) . "</i></td>                                     <td>{$rule['severity']}</td>                                     <td>{$rule['id']}</td>                                 </tr>

Fixed version (after fix):
                             echo "                                 <tr>                                     <td>{$rule['name']}</td>                                     <td><i>" . htmlentities(strip_tags($rule_display)) . "</i></td>                                     <td>{$rule['severity']}</td>                                     <td>{$rule['id']}</td>                                 </tr>

Patch:
patch: @@ -62,7 +62,7 @@
                             echo "
                                 <tr>
                                     <td>{$rule['name']}</td>
-                                    <td><i>" . htmlentities($rule_display) . "</i></td>
+                                    <td><i>" . htmlentities(strip_tags($rule_display)) . "</i></td>
                                     <td>{$rule['severity']}</td>
                                     <td>{$rule['id']}</td>
                                 </tr>
path: includes/html/modal/alert_rule_list.inc.php
Vulnerability: pimcore is vulnerable to SQL Injection pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Vulnerability ID: GHSA-vj9x-w7ch-f46p
CWE: CWE-89
Severity score: 8.3
Project: https://github.com/pimcore/pimcore
Published: 2022-01-21
File: bundles/AdminBundle/Controller/Admin/DataObject/ClassificationstoreController.php
Commit message: [Data Object] Classification Store quote filtering
Commit author: Bernhard Rusch

Vulnerable version (before fix):
 public function propertiesGetAction(Request $request)         }          if ($storeId) {             $conditionParts[] = '(storeId = ' . $storeId . ')';         }          if ($request->get('filter')) {

Fixed version (after fix):
 public function propertiesGetAction(Request $request)         }          if ($storeId) {             $conditionParts[] = '(storeId = '. $db->quote($storeId) . ')';         }          if ($request->get('filter')) {

Patch:
patch: @@ -1242,7 +1242,7 @@ public function propertiesGetAction(Request $request)
         }
 
         if ($storeId) {
-            $conditionParts[] = '(storeId = ' . $storeId . ')';
+            $conditionParts[] = '(storeId = '. $db->quote($storeId) . ')';
         }
 
         if ($request->get('filter')) {
path: bundles/AdminBundle/Controller/Admin/DataObject/ClassificationstoreController.php
Vulnerability: NULL Pointer Dereference in HyperLedger Fabric A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
Vulnerability ID: GHSA-vjj6-5m9f-wqjw
CWE: CWE-476
Severity score: 7.5
Project: https://github.com/hyperledger/fabric
Published: 2022-05-25
File: protoutil/commonutils.go
Commit message: FAB18529 added nil check in channel header parsing

Fuzz testing has reported SEGV while sending incomplete/null
message request to orderer.

Signed-off-by: Parameswaran Selvam <parselva@in.ibm.com>
Commit author: Parameswaran Selvam

Vulnerable version (before fix):
 func IsConfigBlock(block *cb.Block) bool {  // ChannelHeader returns the *cb.ChannelHeader for a given *cb.Envelope. func ChannelHeader(env *cb.Envelope) (*cb.ChannelHeader, error) { 	envPayload, err := UnmarshalPayload(env.Payload) 	if err != nil { 		return nil, err

Fixed version (after fix):
 func IsConfigBlock(block *cb.Block) bool {  // ChannelHeader returns the *cb.ChannelHeader for a given *cb.Envelope. func ChannelHeader(env *cb.Envelope) (*cb.ChannelHeader, error) { 	if env == nil { 		return nil, errors.New("Invalid envelope payload. can't be nil") 	}  	envPayload, err := UnmarshalPayload(env.Payload) 	if err != nil { 		return nil, err

Patch:
patch: @@ -212,6 +212,10 @@ func IsConfigBlock(block *cb.Block) bool {
 
 // ChannelHeader returns the *cb.ChannelHeader for a given *cb.Envelope.
 func ChannelHeader(env *cb.Envelope) (*cb.ChannelHeader, error) {
+	if env == nil {
+		return nil, errors.New("Invalid envelope payload. can't be nil")
+	}
+
 	envPayload, err := UnmarshalPayload(env.Payload)
 	if err != nil {
 		return nil, err
path: protoutil/commonutils.go
Vulnerability: OS Command Injection in Microweber Microweber is a content management system with drag and drop. Prior to version 1.2.11, Microweber is vulnerable to OS Command Injection.
Vulnerability ID: GHSA-vm37-j55j-8655
CWE: CWE-78
Severity score: 7.8
Project: https://github.com/microweber/microweber
Published: 2022-02-12
File: src/MicroweberPackages/App/functions/plupload.php
Commit message: Update plupload.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
                             $is_ext = strtolower($is_ext);                              switch ($is_ext) {                                 case 'php':                                 case 'php12':                                 case 'php11':                                 case 'php10':                                 case 'php9':                                 case 'php8':                                 case 'php7':                                 case 'php6':                                 case 'php5':                                 case 'php4':                                 case 'php3':

Fixed version (after fix):
                             $is_ext = strtolower($is_ext);                              switch ($is_ext) {                                 case 'php':                                  case 'php12':                                 case 'php11':                                 case 'php10':                                 case 'php9':                                 case 'php8':                                 case 'php7':                                 case 'php5':                                 case 'php4':                                 case 'php3':

Patch:
patch: @@ -149,14 +149,13 @@
                             $is_ext = strtolower($is_ext);
 
                             switch ($is_ext) {
-                                case 'php':
+                                case 'php': 
                                 case 'php12':
                                 case 'php11':
                                 case 'php10':
                                 case 'php9':
                                 case 'php8':
                                 case 'php7':
-                                case 'php6':
                                 case 'php5':
                                 case 'php4':
                                 case 'php3':
path: src/MicroweberPackages/App/functions/plupload.php
Vulnerability: node-fetch Inefficient Regular Expression Complexity  [node-fetch](https://www.npmjs.com/package/node-fetch) is a light-weight module that brings window.fetch to node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the `isOriginPotentiallyTrustworthy()` function in `referrer.js`, when processing a URL string with alternating letters and periods, such as `'http://' + 'a.a.'.repeat(i) + 'a'`.
Vulnerability ID: GHSA-vp56-6g26-6827
CWE: CWE-400
Severity score: 5.9
Project: https://github.com/node-fetch/node-fetch
Published: 2022-08-02
File: src/utils/referrer.js
Commit message: fix: ReDoS referrer (#1611)

* fix ReDoS referrer

* Update src/utils/referrer.js

Eliminate regex and use string matcher

Co-authored-by: Linus Unnebäck <linus@folkdatorn.se>

Co-authored-by: Khang. Võ Vĩ <khangvv@vng.com.vn>
Co-authored-by: Linus Unnebäck <linus@folkdatorn.se>
Commit author: Khang Vo (doublevkay)

Vulnerable version (before fix):
 export function isOriginPotentiallyTrustworthy(url) { 	// 5. If origin's host component is "localhost" or falls within ".localhost", and the user agent conforms to the name resolution rules in [let-localhost-be-localhost], return "Potentially Trustworthy". 	// We are returning FALSE here because we cannot ensure conformance to 	// let-localhost-be-loalhost (https://tools.ietf.org/html/draft-west-let-localhost-be-localhost) 	if (/^(.+\.)*localhost$/.test(url.host)) { 		return false; 	} 

Fixed version (after fix):
 export function isOriginPotentiallyTrustworthy(url) { 	// 5. If origin's host component is "localhost" or falls within ".localhost", and the user agent conforms to the name resolution rules in [let-localhost-be-localhost], return "Potentially Trustworthy". 	// We are returning FALSE here because we cannot ensure conformance to 	// let-localhost-be-loalhost (https://tools.ietf.org/html/draft-west-let-localhost-be-localhost) 	if (url.host === 'localhost' || url.host.endsWith('.localhost')) { 		return false; 	} 

Patch:
patch: @@ -119,7 +119,7 @@ export function isOriginPotentiallyTrustworthy(url) {
 	// 5. If origin's host component is "localhost" or falls within ".localhost", and the user agent conforms to the name resolution rules in [let-localhost-be-localhost], return "Potentially Trustworthy".
 	// We are returning FALSE here because we cannot ensure conformance to
 	// let-localhost-be-loalhost (https://tools.ietf.org/html/draft-west-let-localhost-be-localhost)
-	if (/^(.+\.)*localhost$/.test(url.host)) {
+	if (url.host === 'localhost' || url.host.endsWith('.localhost')) {
 		return false;
 	}
path: src/utils/referrer.js