rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Cross-site Scripting in microweber Microweber Cross-site Scripting (XSS) - Stored XSS vulnerability on admin page up to version 1.3.
Vulnerability ID: GHSA-6m26-25q2-cq46
CWE: CWE-79
Severity score: 4.8
Project: https://github.com/microweber/microweber
Published: 2022-02-27
File: src/MicroweberPackages/Media/MediaManager.php
Commit message: add xss clean to create media dir method
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
  use Conner\Tagging\Model\Tagged; use \Intervention\Image\ImageManagerStatic as Image; use MicroweberPackages\Media\Models\Media; use MicroweberPackages\Media\Models\MediaThumbnail; use MicroweberPackages\Utils\Media\Thumbnailer; public function thumbnail_img($params)      public function create_media_dir($params)     {         must_have_access();         $resp = array();         // $target_path = media_base_path() . 'uploaded' . DS; public function create_media_dir($params)              $target_path = $fn_path;         }         if (!isset($_REQUEST['name'])) {             $resp = array('error' => 'You must send new_folder parameter');         } else {             $fn_new_folder_path = $_REQUEST['name'];

Fixed version (after fix):
  use Conner\Tagging\Model\Tagged; use \Intervention\Image\ImageManagerStatic as Image; use MicroweberPackages\Helper\HTMLClean; use MicroweberPackages\Media\Models\Media; use MicroweberPackages\Media\Models\MediaThumbnail; use MicroweberPackages\Utils\Media\Thumbnailer; public function thumbnail_img($params)      public function create_media_dir($params)     {          $clean = new HTMLClean();         $_REQUEST = $clean->cleanArray($_REQUEST);          must_have_access();         $resp = array();         // $target_path = media_base_path() . 'uploaded' . DS; public function create_media_dir($params)              $target_path = $fn_path;         }         if (!isset($_REQUEST['name']) || empty($_REQUEST['name'])) {             $resp = array('error' => 'You must send new_folder parameter');         } else {             $fn_new_folder_path = $_REQUEST['name'];

Patch:
patch: @@ -4,6 +4,7 @@
 
 use Conner\Tagging\Model\Tagged;
 use \Intervention\Image\ImageManagerStatic as Image;
+use MicroweberPackages\Helper\HTMLClean;
 use MicroweberPackages\Media\Models\Media;
 use MicroweberPackages\Media\Models\MediaThumbnail;
 use MicroweberPackages\Utils\Media\Thumbnailer;
@@ -1184,6 +1185,10 @@ public function thumbnail_img($params)
 
     public function create_media_dir($params)
     {
+
+        $clean = new HTMLClean();
+        $_REQUEST = $clean->cleanArray($_REQUEST);
+
         must_have_access();
         $resp = array();
         // $target_path = media_base_path() . 'uploaded' . DS;
@@ -1198,7 +1203,7 @@ public function create_media_dir($params)
 
             $target_path = $fn_path;
         }
-        if (!isset($_REQUEST['name'])) {
+        if (!isset($_REQUEST['name']) || empty($_REQUEST['name'])) {
             $resp = array('error' => 'You must send new_folder parameter');
         } else {
             $fn_new_folder_path = $_REQUEST['name'];
path: src/MicroweberPackages/Media/MediaManager.php
Vulnerability: OS Command Injection in mversion The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
Vulnerability ID: GHSA-6m8p-4fxj-pgc2
CWE: CWE-78
Severity score: 7.8
Project: https://github.com/mikaelbr/mversion
Published: 2021-05-17
File: lib/git.js
Commit message: Fix Remote Command Execution
Commit author: hbkhan

Vulnerable version (before fix):
 module.exports.commit = function (files, message, newVer, tagName, callback) {      function (done) {       cp.exec(         [gitApp, "tag", "-a", tagName, "-m", message].join(" "),         gitExtra,         done       );

Fixed version (after fix):
 module.exports.commit = function (files, message, newVer, tagName, callback) {      function (done) {       cp.exec(         [gitApp, "tag", "-a", escapeQuotes(tagName), "-m", message].join(" "),         gitExtra,         done       );

Patch:
patch: @@ -61,7 +61,7 @@ module.exports.commit = function (files, message, newVer, tagName, callback) {
 
     function (done) {
       cp.exec(
-        [gitApp, "tag", "-a", tagName, "-m", message].join(" "),
+        [gitApp, "tag", "-a", escapeQuotes(tagName), "-m", message].join(" "),
         gitExtra,
         done
       );
path: lib/git.js
Vulnerability: NumPy Buffer Overflow (Disputed) A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service.

NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.
Vulnerability ID: GHSA-6p56-wp2h-9hxr
CWE: CWE-120
Severity score: 5.3
Project: https://github.com/numpy/numpy
Published: 2022-01-07
File: numpy/core/src/multiarray/ctors.c
Commit message: Merge pull request #18989 from yetanothercheer/gh-18939-potential_buffer_overflow

BUG: fix potential buffer overflow(#18939)
Commit author: Charles Harris

Vulnerable version (before fix):
 PyArray_NewFromDescr_int(     int i;     npy_intp nbytes;      if (descr->subarray) {         PyObject *ret;         npy_intp newdims[2*NPY_MAXDIMS]; PyArray_NewFromDescr_int(         return ret;     }      if ((unsigned int)nd > (unsigned int)NPY_MAXDIMS) {         PyErr_Format(PyExc_ValueError,                      "number of dimensions must be within [0, %d]",                      NPY_MAXDIMS);         Py_DECREF(descr);         return NULL;     }      /* Check datatype element size */     nbytes = descr->elsize;     if (PyDataType_ISUNSIZED(descr)) {

Fixed version (after fix):
 PyArray_NewFromDescr_int(     int i;     npy_intp nbytes;      if ((unsigned int)nd > (unsigned int)NPY_MAXDIMS) {         PyErr_Format(PyExc_ValueError,                      "number of dimensions must be within [0, %d]",                      NPY_MAXDIMS);         Py_DECREF(descr);         return NULL;     }      if (descr->subarray) {         PyObject *ret;         npy_intp newdims[2*NPY_MAXDIMS]; PyArray_NewFromDescr_int(         return ret;     }      /* Check datatype element size */     nbytes = descr->elsize;     if (PyDataType_ISUNSIZED(descr)) {

Patch:
patch: @@ -668,6 +668,14 @@ PyArray_NewFromDescr_int(
     int i;
     npy_intp nbytes;
 
+    if ((unsigned int)nd > (unsigned int)NPY_MAXDIMS) {
+        PyErr_Format(PyExc_ValueError,
+                     "number of dimensions must be within [0, %d]",
+                     NPY_MAXDIMS);
+        Py_DECREF(descr);
+        return NULL;
+    }
+
     if (descr->subarray) {
         PyObject *ret;
         npy_intp newdims[2*NPY_MAXDIMS];
@@ -687,14 +695,6 @@ PyArray_NewFromDescr_int(
         return ret;
     }
 
-    if ((unsigned int)nd > (unsigned int)NPY_MAXDIMS) {
-        PyErr_Format(PyExc_ValueError,
-                     "number of dimensions must be within [0, %d]",
-                     NPY_MAXDIMS);
-        Py_DECREF(descr);
-        return NULL;
-    }
-
     /* Check datatype element size */
     nbytes = descr->elsize;
     if (PyDataType_ISUNSIZED(descr)) {
path: numpy/core/src/multiarray/ctors.c
Vulnerability: showdoc is vulnerable to Cross-Site Request Forgery (CSRF) showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability ID: GHSA-6pqm-xvfc-w7p4
CWE: CWE-352
Severity score: 6.5
Project: https://github.com/star7th/showdoc
Published: 2021-12-03
File: server/index.php
Commit message: Cookie security /Cookie 安全
Commit author: star7th

Vulnerable version (before fix):
     require './vendor/autoload.php'; }  // 开启调试模式 建议开发阶段开启 部署阶段注释或者设为false define('APP_DEBUG',True); 

Fixed version (after fix):
     require './vendor/autoload.php'; }  // cookie安全，给PHPSESSID加上Strict if (PHP_VERSION_ID >= 70300) {     session_set_cookie_params([         'samesite' => 'Strict'     ]); } else {      session_set_cookie_params(         NULL,         '/; samesite=Strict',     ); }  // 开启调试模式 建议开发阶段开启 部署阶段注释或者设为false define('APP_DEBUG',True); 

Patch:
patch: @@ -8,6 +8,18 @@
     require './vendor/autoload.php';
 }
 
+// cookie安全，给PHPSESSID加上Strict
+if (PHP_VERSION_ID >= 70300) {
+    session_set_cookie_params([
+        'samesite' => 'Strict'
+    ]);
+} else { 
+    session_set_cookie_params(
+        NULL,
+        '/; samesite=Strict',
+    );
+}
+
 // 开启调试模式 建议开发阶段开启 部署阶段注释或者设为false
 define('APP_DEBUG',True);
path: server/index.php
Vulnerability: Cross-site Scripting in Pimcore Pimcore version 10.3.2 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 10.3.3.
Vulnerability ID: GHSA-6qcc-whgp-pjj2
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/pimcore/pimcore
Published: 2022-03-05
File: bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
Commit message: escaping fields in SERP preview
Commit author: JiaJia Ji

Vulnerable version (before fix):
 pimcore.document.pages.settings = Class.create(pimcore.document.settings_abstrac             var updateSerpPreview = function () {                  var metaPanel = this.layout.getComponent("metaDataPanel");                 var title = metaPanel.getComponent("title").getValue();                 var description = metaPanel.getComponent("description").getValue();                  var truncate = function( text, n ){                     if (text.length <= n) { return text; }

Fixed version (after fix):
 pimcore.document.pages.settings = Class.create(pimcore.document.settings_abstrac             var updateSerpPreview = function () {                  var metaPanel = this.layout.getComponent("metaDataPanel");                 var title = htmlspecialchars(metaPanel.getComponent("title").getValue());                 var description = htmlspecialchars(metaPanel.getComponent("description").getValue());                  var truncate = function( text, n ){                     if (text.length <= n) { return text; }

Patch:
patch: @@ -79,8 +79,8 @@ pimcore.document.pages.settings = Class.create(pimcore.document.settings_abstrac
             var updateSerpPreview = function () {
 
                 var metaPanel = this.layout.getComponent("metaDataPanel");
-                var title = metaPanel.getComponent("title").getValue();
-                var description = metaPanel.getComponent("description").getValue();
+                var title = htmlspecialchars(metaPanel.getComponent("title").getValue());
+                var description = htmlspecialchars(metaPanel.getComponent("description").getValue());
 
                 var truncate = function( text, n ){
                     if (text.length <= n) { return text; }
path: bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
Vulnerability: Cross-Site Request Forgery in Filebrowser A Cross-Site Request Forgery (CSRF) vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim.
Vulnerability ID: GHSA-72wf-hwcq-65h9
CWE: CWE-352
Severity score: 8.8
Project: https://github.com/filebrowser/filebrowser
Published: 2022-02-05
File: http/commands.go
Commit message: fix: security issue in command runner (closes #1621)
Commit author: Oleg Lobanov

Vulnerable version (before fix):
 var commandsHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *d 		} 	}  	if !d.server.EnableExec || !d.user.CanExecute(strings.Split(raw, " ")[0]) { 		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet 			wsErr(conn, r, http.StatusInternalServerError, err) 		}  		return 0, nil 	}  	command, err := runner.ParseCommand(d.settings, raw) 	if err != nil { 		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet 			wsErr(conn, r, http.StatusInternalServerError, err) 		} 		return 0, nil 	} 

Fixed version (after fix):
 var commandsHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *d 		} 	}  	command, err := runner.ParseCommand(d.settings, raw) 	if err != nil { 		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet 			wsErr(conn, r, http.StatusInternalServerError, err) 		} 		return 0, nil 	}  	if !d.server.EnableExec || !d.user.CanExecute(command[0]) { 		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet 			wsErr(conn, r, http.StatusInternalServerError, err) 		}  		return 0, nil 	} 

Patch:
patch: @@ -59,19 +59,19 @@ var commandsHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *d
 		}
 	}
 
-	if !d.server.EnableExec || !d.user.CanExecute(strings.Split(raw, " ")[0]) {
-		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet
+	command, err := runner.ParseCommand(d.settings, raw)
+	if err != nil {
+		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet
 			wsErr(conn, r, http.StatusInternalServerError, err)
 		}
-
 		return 0, nil
 	}
 
-	command, err := runner.ParseCommand(d.settings, raw)
-	if err != nil {
-		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet
+	if !d.server.EnableExec || !d.user.CanExecute(command[0]) {
+		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet
 			wsErr(conn, r, http.StatusInternalServerError, err)
 		}
+
 		return 0, nil
 	}
path: http/commands.go
Vulnerability: icecoder is vulnerable to Cross-site Scripting icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: GHSA-73q9-7pwj-gm46
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/icecoder/icecoder
Published: 2022-01-21
File: editor.php
Commit message: rXSS cleaned username in editor info display
Commit author: Matt Pass

Vulnerable version (before fix):
             ?>             <h2><?php echo $t['multi-user']; ?></h2>             <span class="heading"><?php echo $t['Username']; ?></span><br>             <?php echo $_SESSION['username'];?><br><br>             <?php         }         ?>

Fixed version (after fix):
             ?>             <h2><?php echo $t['multi-user']; ?></h2>             <span class="heading"><?php echo $t['Username']; ?></span><br>             <?php echo xssClean($_SESSION['username'], "html");?><br><br>             <?php         }         ?>

Patch:
patch: @@ -150,7 +150,7 @@
             ?>
             <h2><?php echo $t['multi-user']; ?></h2>
             <span class="heading"><?php echo $t['Username']; ?></span><br>
-            <?php echo $_SESSION['username'];?><br><br>
+            <?php echo xssClean($_SESSION['username'], "html");?><br><br>
             <?php
         }
         ?>
path: editor.php
Vulnerability: Prototype Pollution in @apollo/gateway Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

Upgrade to version 0.6.2 or later.
Vulnerability ID: GHSA-74cr-77xc-8g6r
CWE: CWE-400
Severity score: 7.3
Project: https://github.com/apollographql/apollo-server
Published: 2019-06-13
File: packages/apollo-gateway/src/utilities/deepMerge.ts
Commit message: Ignore __proto__ fields in deepMerge
Commit author: Trevor Scheer

Vulnerable version (before fix):
 export function deepMerge(target: any, source: any): any {   if (source === undefined || source === null) return target;    for (const key of Object.keys(source)) {     if (source[key] === undefined) continue;      if (target[key] && isObject(source[key])) {       deepMerge(target[key], source[key]);

Fixed version (after fix):
 export function deepMerge(target: any, source: any): any {   if (source === undefined || source === null) return target;    for (const key of Object.keys(source)) {     if (source[key] === undefined || key === '__proto__') continue;      if (target[key] && isObject(source[key])) {       deepMerge(target[key], source[key]);

Patch:
patch: @@ -4,7 +4,7 @@ export function deepMerge(target: any, source: any): any {
   if (source === undefined || source === null) return target;
 
   for (const key of Object.keys(source)) {
-    if (source[key] === undefined) continue;
+    if (source[key] === undefined || key === '__proto__') continue;
 
     if (target[key] && isObject(source[key])) {
       deepMerge(target[key], source[key]);
path: packages/apollo-gateway/src/utilities/deepMerge.ts
Vulnerability: Out of bounds read and write in Tensorflow ### Impact
There is a typo in TensorFlow's [`SpecializeType`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L81-L102) which results in heap OOB read/write:

```cc
for (int i = 0; i < op_def.output_arg_size(); i++) {
  // ...
  for (int j = 0; j < t->args_size(); j++) {
    auto* arg = t->mutable_args(i);
    // ...
  }
} 
```

Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.

### Patches
We have patched the issue in GitHub commit [0657c83d08845cc434175934c642299de2c0f042](https://github.com/tensorflow/tensorflow/commit/0657c83d08845cc434175934c642299de2c0f042).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability ID: GHSA-77gp-3h4r-6428
CWE: CWE-125
Severity score: 8.8
Project: https://github.com/tensorflow/tensorflow
Published: 2022-02-09
File: tensorflow/core/framework/full_type_util.cc
Commit message: Fix heap OOB read/write due to incorrect indexing.

PiperOrigin-RevId: 408578046
Change-Id: Ifc9ffea49e5890f55fcb2c27568611052c3ddcfa
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 StatusOr<FullTypeDef> SpecializeType(const AttrSlice& attrs,     // verifications are needed, they should be done by separately, and in a     // way that can be reused for type inference.     for (int j = 0; j < t->args_size(); j++) {       auto* arg = t->mutable_args(i);       if (arg->type_id() == TFT_VAR) {         const auto* attr = attrs.Find(arg->s());         if (attr == nullptr) {

Fixed version (after fix):
 StatusOr<FullTypeDef> SpecializeType(const AttrSlice& attrs,     // verifications are needed, they should be done by separately, and in a     // way that can be reused for type inference.     for (int j = 0; j < t->args_size(); j++) {       auto* arg = t->mutable_args(j);       if (arg->type_id() == TFT_VAR) {         const auto* attr = attrs.Find(arg->s());         if (attr == nullptr) {

Patch:
patch: @@ -100,7 +100,7 @@ StatusOr<FullTypeDef> SpecializeType(const AttrSlice& attrs,
     // verifications are needed, they should be done by separately, and in a
     // way that can be reused for type inference.
     for (int j = 0; j < t->args_size(); j++) {
-      auto* arg = t->mutable_args(i);
+      auto* arg = t->mutable_args(j);
       if (arg->type_id() == TFT_VAR) {
         const auto* attr = attrs.Find(arg->s());
         if (attr == nullptr) {
path: tensorflow/core/framework/full_type_util.cc
Vulnerability: Out of bounds read and write in Tensorflow ### Impact
There is a typo in TensorFlow's [`SpecializeType`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L81-L102) which results in heap OOB read/write:

```cc
for (int i = 0; i < op_def.output_arg_size(); i++) {
  // ...
  for (int j = 0; j < t->args_size(); j++) {
    auto* arg = t->mutable_args(i);
    // ...
  }
} 
```

Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.

### Patches
We have patched the issue in GitHub commit [0657c83d08845cc434175934c642299de2c0f042](https://github.com/tensorflow/tensorflow/commit/0657c83d08845cc434175934c642299de2c0f042).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability ID: GHSA-77gp-3h4r-6428
CWE: CWE-787
Severity score: 8.8
Project: https://github.com/tensorflow/tensorflow
Published: 2022-02-09
File: tensorflow/core/framework/full_type_util.cc
Commit message: Fix heap OOB read/write due to incorrect indexing.

PiperOrigin-RevId: 408578046
Change-Id: Ifc9ffea49e5890f55fcb2c27568611052c3ddcfa
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 StatusOr<FullTypeDef> SpecializeType(const AttrSlice& attrs,     // verifications are needed, they should be done by separately, and in a     // way that can be reused for type inference.     for (int j = 0; j < t->args_size(); j++) {       auto* arg = t->mutable_args(i);       if (arg->type_id() == TFT_VAR) {         const auto* attr = attrs.Find(arg->s());         if (attr == nullptr) {

Fixed version (after fix):
 StatusOr<FullTypeDef> SpecializeType(const AttrSlice& attrs,     // verifications are needed, they should be done by separately, and in a     // way that can be reused for type inference.     for (int j = 0; j < t->args_size(); j++) {       auto* arg = t->mutable_args(j);       if (arg->type_id() == TFT_VAR) {         const auto* attr = attrs.Find(arg->s());         if (attr == nullptr) {

Patch:
patch: @@ -100,7 +100,7 @@ StatusOr<FullTypeDef> SpecializeType(const AttrSlice& attrs,
     // verifications are needed, they should be done by separately, and in a
     // way that can be reused for type inference.
     for (int j = 0; j < t->args_size(); j++) {
-      auto* arg = t->mutable_args(i);
+      auto* arg = t->mutable_args(j);
       if (arg->type_id() == TFT_VAR) {
         const auto* attr = attrs.Find(arg->s());
         if (attr == nullptr) {
path: tensorflow/core/framework/full_type_util.cc