rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.
Vulnerability ID: CVE-2021-21258
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/glpi-project/glpi
Published: 2021-03-02
File: ajax/kanban.php
Commit message: Prevent XSS on Kanban
Commit author: Johan Cwiklinski

Vulnerable version (before fix):
    parse_str($input, $_REQUEST); }  if (!isset($_REQUEST['action'])) {    Toolbox::logError("Missing action parameter");    http_response_code(400);

Fixed version (after fix):
    parse_str($input, $_REQUEST); }  $_REQUEST = Toolbox::clean_cross_side_scripting_deep($_REQUEST);  if (!isset($_REQUEST['action'])) {    Toolbox::logError("Missing action parameter");    http_response_code(400);

Patch:
patch: @@ -47,6 +47,8 @@
    parse_str($input, $_REQUEST);
 }
 
+$_REQUEST = Toolbox::clean_cross_side_scripting_deep($_REQUEST);
+
 if (!isset($_REQUEST['action'])) {
    Toolbox::logError("Missing action parameter");
    http_response_code(400);
path: ajax/kanban.php
Vulnerability: PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2
Vulnerability ID: CVE-2021-21308
CWE: CWE-287
Severity score: 4.9
Project: https://github.com/PrestaShop/PrestaShop
Published: 2021-02-26
File: classes/Cookie.php
Commit message: Merge pull request from GHSA-557h-hf3c-whcg

Make sure session is cleared using soft logout
Commit author: GoT

Vulnerable version (before fix):
 public function logout()      */     public function mylogout()     {         unset(             $this->_content['id_customer'],             $this->_content['id_guest'], public function deleteSession()      */     public function isSessionAlive()     {         if (!isset($this->session_id, $this->session_token)) {             return false;         } 

Fixed version (after fix):
 public function logout()      */     public function mylogout()     {         $this->deleteSession();         unset(             $this->_content['id_customer'],             $this->_content['id_guest'], public function deleteSession()      */     public function isSessionAlive()     {         if (!isset($this->session_id) || !isset($this->session_token)) {             return false;         } 

Patch:
patch: @@ -262,6 +262,7 @@ public function logout()
      */
     public function mylogout()
     {
+        $this->deleteSession();
         unset(
             $this->_content['id_customer'],
             $this->_content['id_guest'],
@@ -514,7 +515,7 @@ public function deleteSession()
      */
     public function isSessionAlive()
     {
-        if (!isset($this->session_id, $this->session_token)) {
+        if (!isset($this->session_id) || !isset($this->session_token)) {
             return false;
         }
path: classes/Cookie.php
Vulnerability: RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enabled are able to log in without a valid token. This is fixed in commit cebb67b.
Vulnerability ID: CVE-2021-21329
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/ractf/core
Published: 2021-03-08
File: src/authentication/views.py
Commit message: Merge pull request from GHSA-fw57-f7mq-9q85
Commit author: David Cooke

Vulnerable version (before fix):
 def post(self, request, *args, **kwargs):                     code.delete()                     return self.issue_token(user)          return self.issue_token(user)   class RegenerateBackupCodesView(APIView):

Fixed version (after fix):
 def post(self, request, *args, **kwargs):                     code.delete()                     return self.issue_token(user)          return FormattedResponse(status=HTTP_401_UNAUTHORIZED, d={'reason': 'login_failed'}, m='login_failed')   class RegenerateBackupCodesView(APIView):

Patch:
patch: @@ -150,7 +150,7 @@ def post(self, request, *args, **kwargs):
                     code.delete()
                     return self.issue_token(user)
 
-        return self.issue_token(user)
+        return FormattedResponse(status=HTTP_401_UNAUTHORIZED, d={'reason': 'login_failed'}, m='login_failed')
 
 
 class RegenerateBackupCodesView(APIView):
path: src/authentication/views.py
Vulnerability: In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.
Vulnerability ID: CVE-2021-21335
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/stnoonan/spnego-http-auth-nginx-module
Published: 2021-03-08
File: ngx_http_auth_spnego_module.c
Commit message: Check basic auth result against != NGX_OK rather than == NGX_DECLINED

This corrects the error handling case when ngx_http_auth_spnego_basic is called with a bad configuration or bad username. These cases return NGX_ERROR, which allowed basic auth to proceed.

Thanks to Prakapovich Pavel aka Flyguy.by for pointing this out.
Commit author: Sean Timothy Noonan

Vulnerable version (before fix):
 ngx_http_auth_spnego_handler(             /* If basic auth is enabled and basic creds are supplied              * attempt basic auth.  If we attempt basic auth, we do              * not fall through to real SPNEGO */             if (NGX_DECLINED == ngx_http_auth_spnego_basic(r, ctx, alcf)) {                 spnego_debug0("Basic auth failed");                 if (NGX_ERROR == ngx_http_auth_spnego_headers_basic_only(r, ctx, alcf)) {                     spnego_debug0("Error setting headers");

Fixed version (after fix):
 ngx_http_auth_spnego_handler(             /* If basic auth is enabled and basic creds are supplied              * attempt basic auth.  If we attempt basic auth, we do              * not fall through to real SPNEGO */             if (NGX_OK != ngx_http_auth_spnego_basic(r, ctx, alcf)) {                 spnego_debug0("Basic auth failed");                 if (NGX_ERROR == ngx_http_auth_spnego_headers_basic_only(r, ctx, alcf)) {                     spnego_debug0("Error setting headers");

Patch:
patch: @@ -1043,7 +1043,7 @@ ngx_http_auth_spnego_handler(
             /* If basic auth is enabled and basic creds are supplied
              * attempt basic auth.  If we attempt basic auth, we do
              * not fall through to real SPNEGO */
-            if (NGX_DECLINED == ngx_http_auth_spnego_basic(r, ctx, alcf)) {
+            if (NGX_OK != ngx_http_auth_spnego_basic(r, ctx, alcf)) {
                 spnego_debug0("Basic auth failed");
                 if (NGX_ERROR == ngx_http_auth_spnego_headers_basic_only(r, ctx, alcf)) {
                     spnego_debug0("Error setting headers");
path: ngx_http_auth_spnego_module.c
Vulnerability: Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to stored cross-site scripting through mustache expressions in code blocks. This vulnerability exists due to mustache expressions being parsed by Vue during content injection even though it is contained within a `<pre>` element. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. For an example see referenced GitHub Security Advisory. Commit 5ffa189383dd716f12b56b8cae2ba0d075996cf1 fixes this vulnerability by adding the v-pre directive to all `<pre>` tags during the render.
Vulnerability ID: CVE-2021-21383
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Requarks/wiki
Published: 2021-03-18
File: server/modules/rendering/html-core/renderer.js
Commit message: fix: add v-pre to pre tags at render time
Commit author: NGPixel

Vulnerable version (before fix):
 module.exports = {     }     iterateMustacheNode($.root())      // --------------------------------     // STEP: POST     // --------------------------------

Fixed version (after fix):
 module.exports = {     }     iterateMustacheNode($.root())      $('pre').each((idx, elm) => {       $(elm).attr('v-pre', true)     })      // --------------------------------     // STEP: POST     // --------------------------------

Patch:
patch: @@ -261,6 +261,10 @@ module.exports = {
     }
     iterateMustacheNode($.root())
 
+    $('pre').each((idx, elm) => {
+      $(elm).attr('v-pre', true)
+    })
+
     // --------------------------------
     // STEP: POST
     // --------------------------------
path: server/modules/rendering/html-core/renderer.js
Vulnerability: An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asylo 0.6.3 or past https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a
Vulnerability ID: CVE-2021-22552
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/google/asylo
Published: 2021-08-02
File: asylo/platform/system_call/system_call.cc
Commit message: Add sysno check in MessageReader

The sysno in MessageReader is interpreted from the Message header passed
from the host. A malicious Message header may provide a modified sysno
to bypass the validation, and overwrites enclave memory. This change
adds a check for sysno to make sure it matches the expected value.

This issue was reported by Qinkun Bao, Zhaofeng Chen, Mingshen Sun, and
Kang Li from Baidu Security.

PiperOrigin-RevId: 377328054
Change-Id: I3ff6f60694d3390f66da89d139cf7cc7b49abaea
Commit author: Chong Cai

Vulnerable version (before fix):
 extern "C" int64_t enc_untrusted_syscall(int sysno, ...) {   // Copy outputs back into pointer parameters.   auto response_reader =       asylo::system_call::MessageReader({response_buffer, response_size});   const asylo::primitives::PrimitiveStatus response_status =       response_reader.Validate();   if (!response_status.ok()) {

Fixed version (after fix):
 extern "C" int64_t enc_untrusted_syscall(int sysno, ...) {   // Copy outputs back into pointer parameters.   auto response_reader =       asylo::system_call::MessageReader({response_buffer, response_size});   if (response_reader.sysno() != sysno) {     error_handler("system_call.cc: Unexpected sysno in response");   }   const asylo::primitives::PrimitiveStatus response_status =       response_reader.Validate();   if (!response_status.ok()) {

Patch:
patch: @@ -115,6 +115,9 @@ extern "C" int64_t enc_untrusted_syscall(int sysno, ...) {
   // Copy outputs back into pointer parameters.
   auto response_reader =
       asylo::system_call::MessageReader({response_buffer, response_size});
+  if (response_reader.sysno() != sysno) {
+    error_handler("system_call.cc: Unexpected sysno in response");
+  }
   const asylo::primitives::PrimitiveStatus response_status =
       response_reader.Validate();
   if (!response_status.ok()) {
path: asylo/platform/system_call/system_call.cc
Vulnerability: Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code.
Vulnerability ID: CVE-2021-22889
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/revive-adserver/revive-adserver
Published: 2021-03-25
File: lib/OA/Admin/Statistics/Common.php
Commit message: Fix h1 report 1097217
Commit author: Matteo Beccati

Vulnerable version (before fix):
 function _loadStatsBreakdownParam()      */     function _loadPeriodPresetParam()     {         $this->aPageParams['statsBreakdown'] = htmlspecialchars(MAX_getStoredValue('statsBreakdown', 'day'));         $this->statsBreakdown = $this->aPageParams['statsBreakdown'];     } 

Fixed version (after fix):
 function _loadStatsBreakdownParam()      */     function _loadPeriodPresetParam()     {         $this->aPageParams['statsBreakdown'] = htmlspecialchars(MAX_getStoredValue('statsBreakdown', 'day'), ENT_QUOTES);         $this->statsBreakdown = $this->aPageParams['statsBreakdown'];     } 

Patch:
patch: @@ -1230,7 +1230,7 @@ function _loadStatsBreakdownParam()
      */
     function _loadPeriodPresetParam()
     {
-        $this->aPageParams['statsBreakdown'] = htmlspecialchars(MAX_getStoredValue('statsBreakdown', 'day'));
+        $this->aPageParams['statsBreakdown'] = htmlspecialchars(MAX_getStoredValue('statsBreakdown', 'day'), ENT_QUOTES);
         $this->statsBreakdown = $this->aPageParams['statsBreakdown'];
     }
path: lib/OA/Admin/Statistics/Common.php
Vulnerability: In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field.
Vulnerability ID: CVE-2021-25924
CWE: CWE-352
Severity score: 10
Project: https://github.com/gocd/gocd
Published: 2021-04-01
File: api/api-backup-config-v1/src/main/java/com/thoughtworks/go/apiv1/backupconfig/BackupConfigControllerV1.java
Commit message: #000 - Add missing Content-Type check
Commit author: Aravind SV

Vulnerable version (before fix):
 public String controllerBasePath() {     public void setupRoutes() {         path(controllerBasePath(), () -> {             before("", mimeType, this::setContentType);               // change the line below to enable appropriate security             before("", mimeType, this.apiAuthenticationHelper::checkAdminUserAnd403);

Fixed version (after fix):
 public String controllerBasePath() {     public void setupRoutes() {         path(controllerBasePath(), () -> {             before("", mimeType, this::setContentType);             before("/*", mimeType, this::setContentType);             before("", mimeType, this::verifyContentType);             before("/*", mimeType, this::verifyContentType);              // change the line below to enable appropriate security             before("", mimeType, this.apiAuthenticationHelper::checkAdminUserAnd403);

Patch:
patch: @@ -65,7 +65,9 @@ public String controllerBasePath() {
     public void setupRoutes() {
         path(controllerBasePath(), () -> {
             before("", mimeType, this::setContentType);
-
+            before("/*", mimeType, this::setContentType);
+            before("", mimeType, this::verifyContentType);
+            before("/*", mimeType, this::verifyContentType);
 
             // change the line below to enable appropriate security
             before("", mimeType, this.apiAuthenticationHelper::checkAdminUserAnd403);
path: api/api-backup-config-v1/src/main/java/com/thoughtworks/go/apiv1/backupconfig/BackupConfigControllerV1.java
Vulnerability: In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
Vulnerability ID: CVE-2021-25990
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ifmeorg/ifme
Published: 2021-12-29
File: client/app/utils/index.js
Commit message: [#2052] Sanitize string content in renderContent
Commit author: Julia Nguyen

Vulnerable version (before fix):
 // @flow import axios from 'axios'; import renderHTML from 'react-render-html';  const randomString = () => Math.random()   .toString(36) const getPusher = () => {  const renderContent = (content: string | any) => {   if (typeof content === 'string') {     return renderHTML(content);   }   return content; };

Fixed version (after fix):
 // @flow import axios from 'axios'; import renderHTML from 'react-render-html'; import { sanitize } from 'dompurify';  const randomString = () => Math.random()   .toString(36) const getPusher = () => {  const renderContent = (content: string | any) => {   if (typeof content === 'string') {     return renderHTML(sanitize(content));   }   return content; };

Patch:
patch: @@ -1,6 +1,7 @@
 // @flow
 import axios from 'axios';
 import renderHTML from 'react-render-html';
+import { sanitize } from 'dompurify';
 
 const randomString = () => Math.random()
   .toString(36)
@@ -34,7 +35,7 @@ const getPusher = () => {
 
 const renderContent = (content: string | any) => {
   if (typeof content === 'string') {
-    return renderHTML(content);
+    return renderHTML(sanitize(content));
   }
   return content;
 };
path: client/app/utils/index.js
Vulnerability: Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.
Vulnerability ID: CVE-2021-26746
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/chamilo/chamilo-lms
Published: 2021-02-19
File: main/calendar/agenda_list.php
Commit message: Agenda: Fix type paremeter #security
Commit author: Julio Montoya

Vulnerable version (before fix):
 ]; Event::registerLog($logInfo);  $type = isset($_REQUEST['type']) ? $_REQUEST['type'] : null;  $interbreadcrumb[] = [     'url' => api_get_path(WEB_CODE_PATH).'calendar/agenda_js.php?type='.Security::remove_XSS($type),

Fixed version (after fix):
 ]; Event::registerLog($logInfo);  $typeList = ['personal', 'course', 'admin', 'platform']; $type = isset($_REQUEST['type']) && in_array($_REQUEST['type'], $typeList, true) ? $_REQUEST['type'] : null;  $interbreadcrumb[] = [     'url' => api_get_path(WEB_CODE_PATH).'calendar/agenda_js.php?type='.Security::remove_XSS($type),

Patch:
patch: @@ -12,7 +12,8 @@
 ];
 Event::registerLog($logInfo);
 
-$type = isset($_REQUEST['type']) ? $_REQUEST['type'] : null;
+$typeList = ['personal', 'course', 'admin', 'platform'];
+$type = isset($_REQUEST['type']) && in_array($_REQUEST['type'], $typeList, true) ? $_REQUEST['type'] : null;
 
 $interbreadcrumb[] = [
     'url' => api_get_path(WEB_CODE_PATH).'calendar/agenda_js.php?type='.Security::remove_XSS($type),
path: main/calendar/agenda_list.php
Vulnerability: Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.
Vulnerability ID: CVE-2021-26799
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/omeka/Omeka
Published: 2021-07-23
File: application/libraries/Omeka/Controller/Plugin/HtmlPurifier.php
Commit message: Apply HTML filtering to files form

(fix #935)
Commit author: John Flatness

Vulnerable version (before fix):
 public function filterCollectionsForm($request, $htmlPurifierFilter = null)         $request->setPost($post);     }      /**      * Purify all of the data in the theme settings      *

Fixed version (after fix):
 public function filterCollectionsForm($request, $htmlPurifierFilter = null)         $request->setPost($post);     }      /**      * Filter the Files form post, including the 'Elements' array of the POST.      *      * @param Zend_Controller_Request_Abstract $request      * @param Omeka_Filter_HtmlPurifier $htmlPurifierFilter      **/     public function filterFilesForm($request, $htmlPurifierFilter = null)     {         if ($htmlPurifierFilter === null) {             $htmlPurifierFilter = new Omeka_Filter_HtmlPurifier();         }          $post = $request->getPost();         $post = $this->_filterElementsFromPost($post, $htmlPurifierFilter);          $request->setPost($post);     }      /**      * Purify all of the data in the theme settings      *

Patch:
patch: @@ -106,6 +106,24 @@ public function filterCollectionsForm($request, $htmlPurifierFilter = null)
         $request->setPost($post);
     }
 
+    /**
+     * Filter the Files form post, including the 'Elements' array of the POST.
+     *
+     * @param Zend_Controller_Request_Abstract $request
+     * @param Omeka_Filter_HtmlPurifier $htmlPurifierFilter
+     **/
+    public function filterFilesForm($request, $htmlPurifierFilter = null)
+    {
+        if ($htmlPurifierFilter === null) {
+            $htmlPurifierFilter = new Omeka_Filter_HtmlPurifier();
+        }
+
+        $post = $request->getPost();
+        $post = $this->_filterElementsFromPost($post, $htmlPurifierFilter);
+
+        $request->setPost($post);
+    }
+
     /**
      * Purify all of the data in the theme settings
      *
path: application/libraries/Omeka/Controller/Plugin/HtmlPurifier.php
Vulnerability: MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).
Vulnerability ID: CVE-2021-27279
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mybb/mybb
Published: 2021-02-22
File: inc/class_parser.php
Commit message: Fix Nested Email MyCode Persistent XSS
Commit author: Tomasz Mlynski

Vulnerable version (before fix):
 function mycode_parse_email($email, $name="") 		{ 			$name = $email; 		} 		if(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+$/si", $email)) 		{ 			$email = $email; 		} 		elseif(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+\?(.*?)$/si", $email)) 		{ 			$email = htmlspecialchars_uni($email); 		}  		eval("\$mycode_email = \"".$templates->get("mycode_email", 1, 0)."\";"); 		return $mycode_email;

Fixed version (after fix):
 function mycode_parse_email($email, $name="") 		{ 			$name = $email; 		}  		$email = $this->encode_url($email);  		eval("\$mycode_email = \"".$templates->get("mycode_email", 1, 0)."\";"); 		return $mycode_email;

Patch:
patch: @@ -1347,14 +1347,8 @@ function mycode_parse_email($email, $name="")
 		{
 			$name = $email;
 		}
-		if(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+$/si", $email))
-		{
-			$email = $email;
-		}
-		elseif(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+\?(.*?)$/si", $email))
-		{
-			$email = htmlspecialchars_uni($email);
-		}
+
+		$email = $this->encode_url($email);
 
 		eval("\$mycode_email = \"".$templates->get("mycode_email", 1, 0)."\";");
 		return $mycode_email;
path: inc/class_parser.php
Vulnerability: SerenityOS Unspecified is affected by: Buffer Overflow. The impact is: obtain sensitive information (context-dependent). The component is: /Userland/Libraries/LibCrypto/ASN1/DER.h Crypto::der_decode_sequence() function. The attack vector is: Parsing RSA Key ASN.1.
Vulnerability ID: CVE-2021-27343
CWE: CWE-120
Severity score: 2.9
Project: https://github.com/SerenityOS/serenity
Published: 2021-04-06
File: Userland/Libraries/LibCrypto/NumberTheory/ModularFunctions.cpp
Commit message: LibCrypto: Don't copy the prime test candidates

This was copying a bunch of bigints for no reason.
Commit author: AnotherTest

Vulnerable version (before fix):
 static bool MR_primality_test(UnsignedBigInteger n, const Vector<UnsignedBigInte         return n == 2;     }      for (auto a : tests) {         // Technically: ASSERT(2 <= a && a <= n - 2)         ASSERT(a < n);         auto x = ModularPower(a, d, n);

Fixed version (after fix):
 static bool MR_primality_test(UnsignedBigInteger n, const Vector<UnsignedBigInte         return n == 2;     }      for (auto& a : tests) {         // Technically: ASSERT(2 <= a && a <= n - 2)         ASSERT(a < n);         auto x = ModularPower(a, d, n);

Patch:
patch: @@ -258,7 +258,7 @@ static bool MR_primality_test(UnsignedBigInteger n, const Vector<UnsignedBigInte
         return n == 2;
     }
 
-    for (auto a : tests) {
+    for (auto& a : tests) {
         // Technically: ASSERT(2 <= a && a <= n - 2)
         ASSERT(a < n);
         auto x = ModularPower(a, d, n);
path: Userland/Libraries/LibCrypto/NumberTheory/ModularFunctions.cpp