rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Denial of Service in hapi Versions of `hapi` prior to 11.1.3 are affected by a denial of service vulnerability.

The vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers.

This causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500 error back to the sender, hapi will continue to hold the socket open until timed out (default node timeout is 2 minutes).





## Recommendation

Update to v11.1.3 or later
Vulnerability ID: GHSA-rc8h-3fv6-pxv8
CWE: CWE-400
Severity score: 0
Project: https://github.com/hapijs/hapi
Published: 2018-06-07
File: lib/transmit.js
Commit message: Merge pull request #2988 from hapijs/v11.1.x

Handle invalid date exceptions
Commit author: Eran Hammer

Vulnerable version (before fix):
 internals.marshal = function (request, next) {                  // Weak verifier                  const ifModifiedSince = Date.parse(ifModifiedSinceHeader);                 const lastModified = Date.parse(lastModifiedHeader);                  if (ifModifiedSince &&                     lastModified && internals.marshal = function (request, next) { };   internals.fail = function (request, boom, callback) {      const error = boom.output;

Fixed version (after fix):
 internals.marshal = function (request, next) {                  // Weak verifier                  const ifModifiedSince = internals.parseDate(ifModifiedSinceHeader);                 const lastModified = internals.parseDate(lastModifiedHeader);                  if (ifModifiedSince &&                     lastModified && internals.marshal = function (request, next) { };   internals.parseDate = function (string) {      try {         return Date.parse(string);     }     catch (errIgnore) { } };   internals.fail = function (request, boom, callback) {      const error = boom.output;

Patch:
patch: @@ -82,8 +82,8 @@ internals.marshal = function (request, next) {
 
                 // Weak verifier
 
-                const ifModifiedSince = Date.parse(ifModifiedSinceHeader);
-                const lastModified = Date.parse(lastModifiedHeader);
+                const ifModifiedSince = internals.parseDate(ifModifiedSinceHeader);
+                const lastModified = internals.parseDate(lastModifiedHeader);
 
                 if (ifModifiedSince &&
                     lastModified &&
@@ -147,6 +147,15 @@ internals.marshal = function (request, next) {
 };
 
 
+internals.parseDate = function (string) {
+
+    try {
+        return Date.parse(string);
+    }
+    catch (errIgnore) { }
+};
+
+
 internals.fail = function (request, boom, callback) {
 
     const error = boom.output;
path: lib/transmit.js
Vulnerability: Improper Neutralization of Input During Web Page Generation in Select2 In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
Vulnerability ID: GHSA-rf66-hmqf-q3fc
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/snipe/snipe-it
Published: 2022-05-14
File: resources/assets/js/snipeit.js
Commit message: Janky fix for Select2 bug
Commit author: snipe

Vulnerable version (before fix):
 $(document).ready(function () {     }      function formatDataSelection (datalist) {         return datalist.text;     }      // This handles the radio button selectors for the checkout-to-foo options

Fixed version (after fix):
 $(document).ready(function () {     }      function formatDataSelection (datalist) {         // This a heinous workaround for a known bug in Select2.         // Without this, the rich selectlists are vulnerable to XSS.         // Many thanks to @uberbrady for this fix. It ain't pretty,         // but it resolves the issue until Select2 addresses it on their end.         //         // Bug was reported in 2016 :{         // https://github.com/select2/select2/issues/4587          return datalist.text.replace(/>/g, '&gt;')             .replace(/</g, '&lt;')             .replace(/"/g, '&quot;')             .replace(/'/g, '&#039;');     }      // This handles the radio button selectors for the checkout-to-foo options

Patch:
patch: @@ -260,7 +260,18 @@ $(document).ready(function () {
     }
 
     function formatDataSelection (datalist) {
-        return datalist.text;
+        // This a heinous workaround for a known bug in Select2.
+        // Without this, the rich selectlists are vulnerable to XSS.
+        // Many thanks to @uberbrady for this fix. It ain't pretty,
+        // but it resolves the issue until Select2 addresses it on their end.
+        //
+        // Bug was reported in 2016 :{
+        // https://github.com/select2/select2/issues/4587
+
+        return datalist.text.replace(/>/g, '&gt;')
+            .replace(/</g, '&lt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#039;');
     }
 
     // This handles the radio button selectors for the checkout-to-foo options
path: resources/assets/js/snipeit.js
Vulnerability: Denial of service in Undertow A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
Vulnerability ID: GHSA-rhcw-wjcm-9h6g
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/undertow-io/undertow
Published: 2022-02-09
File: core/src/main/java/io/undertow/server/handlers/resource/PathResourceManager.java
Commit message: UNDERTOW-1813 Make PathResourceManager.getResource rethrow a SecurityException
Commit author: Boris Unckel

Vulnerable version (before fix):
 public Resource getResource(final String p) {                 log.tracef("Failed to get path resource %s from path resource manager with base %s, as the path did not exist", p, base);                 return null;             }         } catch (Exception e) {             UndertowLogger.REQUEST_LOGGER.debugf(e, "Invalid path %s", p);             return null;         }     } 

Fixed version (after fix):
 public Resource getResource(final String p) {                 log.tracef("Failed to get path resource %s from path resource manager with base %s, as the path did not exist", p, base);                 return null;             }         } catch (IOException e) {             UndertowLogger.REQUEST_LOGGER.debugf(e, "Invalid path %s", p);             return null;         } catch (SecurityException e) {             UndertowLogger.REQUEST_LOGGER.errorf(e, "Missing JSM permissions for path %s", p);             throw e;         } catch (Exception e) {             UndertowLogger.REQUEST_LOGGER.debugf(e, "Other issue for path %s", p);             return null;         }     } 

Patch:
patch: @@ -230,9 +230,15 @@ public Resource getResource(final String p) {
                 log.tracef("Failed to get path resource %s from path resource manager with base %s, as the path did not exist", p, base);
                 return null;
             }
-        } catch (Exception e) {
+        } catch (IOException e) {
             UndertowLogger.REQUEST_LOGGER.debugf(e, "Invalid path %s", p);
             return null;
+        } catch (SecurityException e) {
+            UndertowLogger.REQUEST_LOGGER.errorf(e, "Missing JSM permissions for path %s", p);
+            throw e;
+        } catch (Exception e) {
+            UndertowLogger.REQUEST_LOGGER.debugf(e, "Other issue for path %s", p);
+            return null;
         }
     }
path: core/src/main/java/io/undertow/server/handlers/resource/PathResourceManager.java
Vulnerability: Cross-site Scripting in librenms Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
Vulnerability ID: GHSA-rp34-85x3-3764
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/librenms/librenms
Published: 2022-02-15
File: includes/html/forms/alert-transports.inc.php
Commit message: security - XSS Fix 01

fixing https://huntr.dev/bounties/114ba055-a2f0-4db9-aafb-95df944ba177/ (#13775)
Commit author: PipoCanaja

Vulnerable version (before fix):
 $status = 'ok'; $message = '';  $transport_id = $vars['transport_id']; $name = $vars['name']; $is_default = (int) (isset($vars['is_default']) && $vars['is_default'] == 'on'); $transport_type = $vars['transport-type'];  if (empty($name)) {     $status = 'error';

Fixed version (after fix):
 $status = 'ok'; $message = '';  $transport_id = strip_tags($vars['transport_id']); $name = strip_tags($vars['name']); $is_default = (int) (isset($vars['is_default']) && $vars['is_default'] == 'on'); $transport_type = strip_tags($vars['transport-type']);  if (empty($name)) {     $status = 'error';

Patch:
patch: @@ -34,10 +34,10 @@
 $status = 'ok';
 $message = '';
 
-$transport_id = $vars['transport_id'];
-$name = $vars['name'];
+$transport_id = strip_tags($vars['transport_id']);
+$name = strip_tags($vars['name']);
 $is_default = (int) (isset($vars['is_default']) && $vars['is_default'] == 'on');
-$transport_type = $vars['transport-type'];
+$transport_type = strip_tags($vars['transport-type']);
 
 if (empty($name)) {
     $status = 'error';
path: includes/html/forms/alert-transports.inc.php
Vulnerability: Cross-site Scripting in showdoc/showdoc ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.
Vulnerability ID: GHSA-rphc-h572-2x9f
CWE: CWE-434
Severity score: 9
Project: https://github.com/star7th/showdoc
Published: 2022-03-15
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: file upload bug
Commit author: star7th

Vulnerable version (before fix):
 public function isDangerFilename($filename){ 	public function isAllowedFilename($filename){ 		$allow_array = array( 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp', 			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv', 			'.mov','.webmv','.flac','.mkv', 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub', 			'.pdf','.ofd','.swf','.epub','.xps', 			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps', 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv', 			'.cer','.ppt','.pub','.properties','.json','.css', 			) ;  		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）

Fixed version (after fix):
 public function isDangerFilename($filename){ 	public function isAllowedFilename($filename){ 		$allow_array = array( 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp', 			'.mp3','.wav','.mp4', 			'.mov','.webmv','.flac','.mkv', 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso', 			'.pdf','.ofd','.swf','.epub','.xps', 			'.doc','.docx','.wps', 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv', 			'.cer','.ppt','.pub','.json','.css', 			) ;  		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）

Patch:
patch: @@ -324,13 +324,13 @@ public function isDangerFilename($filename){
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
+			'.mp3','.wav','.mp4',
 			'.mov','.webmv','.flac','.mkv',
-			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
+			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
 			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps',
+			'.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
-			'.cer','.ppt','.pub','.properties','.json','.css',
+			'.cer','.ppt','.pub','.json','.css',
 			) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: Cross-site Scripting in showdoc/showdoc ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.
Vulnerability ID: GHSA-rphc-h572-2x9f
CWE: CWE-79
Severity score: 9
Project: https://github.com/star7th/showdoc
Published: 2022-03-15
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: file upload bug
Commit author: star7th

Vulnerable version (before fix):
 public function isDangerFilename($filename){ 	public function isAllowedFilename($filename){ 		$allow_array = array( 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp', 			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv', 			'.mov','.webmv','.flac','.mkv', 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub', 			'.pdf','.ofd','.swf','.epub','.xps', 			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps', 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv', 			'.cer','.ppt','.pub','.properties','.json','.css', 			) ;  		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）

Fixed version (after fix):
 public function isDangerFilename($filename){ 	public function isAllowedFilename($filename){ 		$allow_array = array( 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp', 			'.mp3','.wav','.mp4', 			'.mov','.webmv','.flac','.mkv', 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso', 			'.pdf','.ofd','.swf','.epub','.xps', 			'.doc','.docx','.wps', 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv', 			'.cer','.ppt','.pub','.json','.css', 			) ;  		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）

Patch:
patch: @@ -324,13 +324,13 @@ public function isDangerFilename($filename){
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
+			'.mp3','.wav','.mp4',
 			'.mov','.webmv','.flac','.mkv',
-			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
+			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
 			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps',
+			'.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
-			'.cer','.ppt','.pub','.properties','.json','.css',
+			'.cer','.ppt','.pub','.json','.css',
 			) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: SQL Injection in Fork CMS Fork CMS is vulnerable to SQL injection through marking blog comments on bulk as spam in versions prior to 5.11.1.
Vulnerability ID: GHSA-rr8m-29g8-8cgc
CWE: CWE-89
Severity score: 8.8
Project: https://github.com/forkcms/forkcms
Published: 2022-03-26
File: src/Backend/Modules/Blog/Engine/Model.php
Commit message: Prevent sql injection through the ids of the blog comments
Commit author: Jelmer Prins

Vulnerable version (before fix):
 public static function getComments(array $ids): array             'SELECT *              FROM blog_comments AS i              WHERE i.id IN (' . implode(', ', array_fill(0, count($ids), '?')) . ')',             $ids         );     } 

Fixed version (after fix):
 public static function getComments(array $ids): array             'SELECT *              FROM blog_comments AS i              WHERE i.id IN (' . implode(', ', array_fill(0, count($ids), '?')) . ')',             array_map('intval', $ids)         );     } 

Patch:
patch: @@ -501,7 +501,7 @@ public static function getComments(array $ids): array
             'SELECT *
              FROM blog_comments AS i
              WHERE i.id IN (' . implode(', ', array_fill(0, count($ids), '?')) . ')',
-            $ids
+            array_map('intval', $ids)
         );
     }
path: src/Backend/Modules/Blog/Engine/Model.php
Vulnerability: snipe-it is vulnerable to Cross-site Scripting snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability ID: GHSA-rxch-gp62-574w
CWE: CWE-79
Severity score: 6.4
Project: https://github.com/snipe/snipe-it
Published: 2021-12-16
File: app/Http/Transformers/AssetsTransformer.php
Commit message: Added escape to assigned_to API response

Signed-off-by: snipe <snipe@snipe.net>
Commit author: snipe

Vulnerable version (before fix):
 public function transformAssignedTo($asset)         }         return $asset->assigned ? [             'id' => $asset->assigned->id,             'name' => $asset->assigned->display_name,             'type' => $asset->assignedType()         ] : null;     }

Fixed version (after fix):
 public function transformAssignedTo($asset)         }         return $asset->assigned ? [             'id' => $asset->assigned->id,             'name' => e($asset->assigned->display_name),             'type' => $asset->assignedType()         ] : null;     }

Patch:
patch: @@ -170,7 +170,7 @@ public function transformAssignedTo($asset)
         }
         return $asset->assigned ? [
             'id' => $asset->assigned->id,
-            'name' => $asset->assigned->display_name,
+            'name' => e($asset->assigned->display_name),
             'type' => $asset->assignedType()
         ] : null;
     }
path: app/Http/Transformers/AssetsTransformer.php
Vulnerability: Regular Expression Denial of Service in underscore.string Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS).

The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.


## Recommendation

Upgrade to version 3.3.5 or higher.
Vulnerability ID: GHSA-v2p6-4mp7-3r9v
CWE: CWE-400
Severity score: 0
Project: https://github.com/epeli/underscore.string
Published: 2019-06-14
File: unescapeHTML.js
Commit message: Try to fix regexp redos

fixes  #510
Commit author: Esa-Matti Suuronen

Vulnerable version (before fix):
 var makeString = require('./helper/makeString'); var htmlEntities = require('./helper/htmlEntities');  module.exports = function unescapeHTML(str) {   return makeString(str).replace(/\&([^;]+);/g, function(entity, entityCode) {     var match;      if (entityCode in htmlEntities) {

Fixed version (after fix):
 var makeString = require('./helper/makeString'); var htmlEntities = require('./helper/htmlEntities');  module.exports = function unescapeHTML(str) {   return makeString(str).replace(/\&([^;]{1,10});/g, function(entity, entityCode) {     var match;      if (entityCode in htmlEntities) {

Patch:
patch: @@ -2,7 +2,7 @@ var makeString = require('./helper/makeString');
 var htmlEntities = require('./helper/htmlEntities');
 
 module.exports = function unescapeHTML(str) {
-  return makeString(str).replace(/\&([^;]+);/g, function(entity, entityCode) {
+  return makeString(str).replace(/\&([^;]{1,10});/g, function(entity, entityCode) {
     var match;
 
     if (entityCode in htmlEntities) {
path: unescapeHTML.js
Vulnerability: Possible SQL injection in tablelookupwizard Contao Extension ### Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.

### Patches
The issue has been patched in `tablelookupwizard` version 3.3.5 and version 4.0.0.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/terminal42/contao-tablelookupwizard
* Email us at [info@terminal42.ch](mailto:info@terminal42.ch)
Vulnerability ID: GHSA-v3mr-gp7j-pw5w
CWE: CWE-89
Severity score: 0
Project: https://github.com/terminal42/contao-tablelookupwizard
Published: 2022-02-10
File: TableLookupWizard.php
Commit message: Fixed SQL query for current field value
Commit author: Andreas Schempp

Vulnerable version (before fix):
 protected function prepareWhere()          // Filter those that have already been chosen         if ('checkbox' === $this->fieldType && \is_array($varData) && !empty($varData)) {             $this->arrWhereProcedure[] = $this->foreignTable.'.id NOT IN ('.implode(',', $varData).')';         } elseif ('radio' === $this->fieldType && '' !== $varData) {             $this->arrWhereProcedure[] = "{$this->foreignTable}.id!='$varData'";         }          // If custom WHERE is set, add it to the statement

Fixed version (after fix):
 protected function prepareWhere()          // Filter those that have already been chosen         if ('checkbox' === $this->fieldType && \is_array($varData) && !empty($varData)) {             $this->arrWhereProcedure[] = $this->foreignTable.'.id NOT IN ('.implode(',', array_map('intval', $varData)).')';         } elseif ('radio' === $this->fieldType && '' !== $varData) {             $this->arrWhereProcedure[] = $this->foreignTable.'.id!='.(int) $varData;         }          // If custom WHERE is set, add it to the statement

Patch:
patch: @@ -407,9 +407,9 @@ protected function prepareWhere()
 
         // Filter those that have already been chosen
         if ('checkbox' === $this->fieldType && \is_array($varData) && !empty($varData)) {
-            $this->arrWhereProcedure[] = $this->foreignTable.'.id NOT IN ('.implode(',', $varData).')';
+            $this->arrWhereProcedure[] = $this->foreignTable.'.id NOT IN ('.implode(',', array_map('intval', $varData)).')';
         } elseif ('radio' === $this->fieldType && '' !== $varData) {
-            $this->arrWhereProcedure[] = "{$this->foreignTable}.id!='$varData'";
+            $this->arrWhereProcedure[] = $this->foreignTable.'.id!='.(int) $varData;
         }
 
         // If custom WHERE is set, add it to the statement
path: TableLookupWizard.php