rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Path Traversal in algo-httpserv Versions of `algo-httpserv` prior to 1.1.2 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 1.1.2 or later.
Vulnerability ID: GHSA-cgjv-rghq-qhgp
CWE: CWE-22
Severity score: 8.6
Project: https://github.com/AlgoRythm-Dylan/httpserv
Published: 2019-09-11
File: httpserv.js
Commit message: Fixed path vulnerability
Commit author: AlgoRythm-Dylan

Vulnerable version (before fix):
 // Stream-based KISS HTTP(S) server  const url = require("url"); const fs = require("fs");  // A small database of MIME associations var MIMES = {     ".zip": "application/zip" }  var servePath = "serve"; function doStream(request, response, filePath, stats, MIME){     let responseOptions = {};     let streamOptions = {}; module.exports.serve = function(request, response){         MIME = MIMES[fileType];     }     // Serve the actual file     var filePath = servePath + path;     let handler = handlers[path];     if(handler !== undefined){         if(handler.requestTypes === null || handler.requestTypes.indexOf(request.method) != -1){

Fixed version (after fix):
 // Stream-based KISS HTTP(S) server  const url = require("url"); const pathlib = require("path") const fs = require("fs");  // A small database of MIME associations var MIMES = {     ".zip": "application/zip" }  var servePath = "serve/"; function doStream(request, response, filePath, stats, MIME){     let responseOptions = {};     let streamOptions = {}; module.exports.serve = function(request, response){         MIME = MIMES[fileType];     }     // Serve the actual file     var filePath = pathlib.join(servePath, path);     if(filePath.indexOf(servePath) !== 0){         response.end();         return;     }     let handler = handlers[path];     if(handler !== undefined){         if(handler.requestTypes === null || handler.requestTypes.indexOf(request.method) != -1){

Patch:
patch: @@ -1,6 +1,7 @@
 // Stream-based KISS HTTP(S) server
 
 const url = require("url");
+const pathlib = require("path")
 const fs = require("fs");
 
 // A small database of MIME associations
@@ -32,7 +33,7 @@ var MIMES = {
     ".zip": "application/zip"
 }
 
-var servePath = "serve";
+var servePath = "serve/";
 function doStream(request, response, filePath, stats, MIME){
     let responseOptions = {};
     let streamOptions = {};
@@ -82,7 +83,11 @@ module.exports.serve = function(request, response){
         MIME = MIMES[fileType];
     }
     // Serve the actual file
-    var filePath = servePath + path;
+    var filePath = pathlib.join(servePath, path);
+    if(filePath.indexOf(servePath) !== 0){
+        response.end();
+        return;
+    }
     let handler = handlers[path];
     if(handler !== undefined){
         if(handler.requestTypes === null || handler.requestTypes.indexOf(request.method) != -1){
path: httpserv.js
Vulnerability: Division by 0 in inplace operations ### Impact
An attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0:

```python
import tensorflow as tf

tf.raw_ops.InplaceSub(x=[],i=[-99,-1,-1],v=[1,1,1])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`.

### Patches
We have patched the issue in GitHub commit [e86605c0a336c088b638da02135ea6f9f6753618](https://github.com/tensorflow/tensorflow/commit/e86605c0a336c088b638da02135ea6f9f6753618).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability ID: GHSA-cm5x-837x-jf3c
CWE: CWE-369
Severity score: 5.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-08-25
File: tensorflow/core/kernels/inplace_ops.cc
Commit message: Fix FPE in inpace update ops.

PiperOrigin-RevId: 388303197
Change-Id: Ib48309b6213ffe53eba81004b00e889d653e4b83
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 class InplaceOpBase : public OpKernel {      Tensor y = x;  // This creates an alias intentionally.     // Skip processing if tensors are empty.     if (x.NumElements() > 0 || v.NumElements() > 0) {       OP_REQUIRES_OK(ctx, DoCompute(ctx, i, v, &y));     }     ctx->set_output(0, y);

Fixed version (after fix):
 class InplaceOpBase : public OpKernel {      Tensor y = x;  // This creates an alias intentionally.     // Skip processing if tensors are empty.     if (x.NumElements() > 0 && v.NumElements() > 0) {       OP_REQUIRES_OK(ctx, DoCompute(ctx, i, v, &y));     }     ctx->set_output(0, y);

Patch:
patch: @@ -225,7 +225,7 @@ class InplaceOpBase : public OpKernel {
 
     Tensor y = x;  // This creates an alias intentionally.
     // Skip processing if tensors are empty.
-    if (x.NumElements() > 0 || v.NumElements() > 0) {
+    if (x.NumElements() > 0 && v.NumElements() > 0) {
       OP_REQUIRES_OK(ctx, DoCompute(ctx, i, v, &y));
     }
     ctx->set_output(0, y);
path: tensorflow/core/kernels/inplace_ops.cc
Vulnerability: Logic error in authentication in proxy.py before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
Vulnerability ID: GHSA-cmc7-mfmr-xqrx
CWE: CWE-287
Severity score: 7.5
Project: https://github.com/abhinavsingh/proxy.py
Published: 2021-04-07
File: proxy/http/proxy/auth.py
Commit message: Fix basic auth condition
Commit author: Abhinav Singh

Vulnerable version (before fix):
 def before_upstream_connection(                 raise ProxyAuthenticationFailed()             parts = request.headers[b'proxy-authorization'][1].split()             if len(parts) != 2 \                     and parts[0].lower() != b'basic' \                     and parts[1] != self.flags.auth_code:                 raise ProxyAuthenticationFailed()         return request 

Fixed version (after fix):
 def before_upstream_connection(                 raise ProxyAuthenticationFailed()             parts = request.headers[b'proxy-authorization'][1].split()             if len(parts) != 2 \                     or parts[0].lower() != b'basic' \                     or parts[1] != self.flags.auth_code:                 raise ProxyAuthenticationFailed()         return request 

Patch:
patch: @@ -35,8 +35,8 @@ def before_upstream_connection(
                 raise ProxyAuthenticationFailed()
             parts = request.headers[b'proxy-authorization'][1].split()
             if len(parts) != 2 \
-                    and parts[0].lower() != b'basic' \
-                    and parts[1] != self.flags.auth_code:
+                    or parts[0].lower() != b'basic' \
+                    or parts[1] != self.flags.auth_code:
                 raise ProxyAuthenticationFailed()
         return request
path: proxy/http/proxy/auth.py
Vulnerability: Incorrect Comparison in axios axios is vulnerable to Inefficient Regular Expression Complexity
Vulnerability ID: GHSA-cph5-m8f7-6c5x
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/axios/axios
Published: 2021-09-01
File: lib/utils.js
Commit message: Security fix for ReDoS (#3980)
Commit author: ready-research

Vulnerable version (before fix):
 function isURLSearchParams(val) {  * @returns {String} The String freed of excess whitespace  */ function trim(str) {   return str.replace(/^\s*/, '').replace(/\s*$/, ''); }  /**

Fixed version (after fix):
 function isURLSearchParams(val) {  * @returns {String} The String freed of excess whitespace  */ function trim(str) {   return str.trim ? str.trim() : str.replace(/^\s+|\s+$/g, ''); }  /**

Patch:
patch: @@ -185,7 +185,7 @@ function isURLSearchParams(val) {
  * @returns {String} The String freed of excess whitespace
  */
 function trim(str) {
-  return str.replace(/^\s*/, '').replace(/\s*$/, '');
+  return str.trim ? str.trim() : str.replace(/^\s+|\s+$/g, '');
 }
 
 /**
path: lib/utils.js
Vulnerability: Java Melody vulnerable to cross-site scripting JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.
Vulnerability ID: GHSA-cqhr-jqvc-qw9p
CWE: CWE-79
Severity score: 10
Project: https://github.com/javamelody/javamelody
Published: 2022-07-20
File: javamelody-core/src/main/java/net/bull/javamelody/HtmlCoreReport.java
Commit message: fix XSS
Commit author: evernat

Vulnerable version (before fix):
 void writeMessageIfNotNull(String message, String partToRedirectTo, 		if (message != null) { 			writeln(SCRIPT_BEGIN); 			// writeDirectly pour ne pas gérer de traductions si le message contient '#' 			writeDirectly("alert(\"" + javascriptEncode(message) + "\");"); 			writeln(""); 			// redirect vers une url évitant que F5 du navigateur ne refasse l'action au lieu de faire un refresh 			if (partToRedirectTo == null) {

Fixed version (after fix):
 void writeMessageIfNotNull(String message, String partToRedirectTo, 		if (message != null) { 			writeln(SCRIPT_BEGIN); 			// writeDirectly pour ne pas gérer de traductions si le message contient '#' 			writeDirectly("alert(\"" + htmlEncodeButNotSpace(javascriptEncode(message)) + "\");"); 			writeln(""); 			// redirect vers une url évitant que F5 du navigateur ne refasse l'action au lieu de faire un refresh 			if (partToRedirectTo == null) {

Patch:
patch: @@ -365,7 +365,7 @@ void writeMessageIfNotNull(String message, String partToRedirectTo,
 		if (message != null) {
 			writeln(SCRIPT_BEGIN);
 			// writeDirectly pour ne pas gérer de traductions si le message contient '#'
-			writeDirectly("alert(\"" + javascriptEncode(message) + "\");");
+			writeDirectly("alert(\"" + htmlEncodeButNotSpace(javascriptEncode(message)) + "\");");
 			writeln("");
 			// redirect vers une url évitant que F5 du navigateur ne refasse l'action au lieu de faire un refresh
 			if (partToRedirectTo == null) {
path: javamelody-core/src/main/java/net/bull/javamelody/HtmlCoreReport.java
Vulnerability: Observable Timing Discrepancy in OpenMage LTS ### Impact
This vulnerability allows to circumvent the **formkey protection** in the Admin Interface and increases the attack surface for  **Cross Site Request Forgery** attacks 

### Patches
The latest OpenMage Versions up from 19.4.6 and 20.0.2 have this Issue solved


### References
Related to Adobes CVE-2020-9690 ( https://helpx.adobe.com/security/products/magento/apsb20-47.html )
fixed in Magento2 https://github.com/magento/magento2/commit/52d72b8010c9cecb5b8e3d98ec5edc1ddcc65fb4
as part of 2.4.0/2.3.5-p2
Vulnerability ID: GHSA-crf2-xm6x-46p6
CWE: CWE-352
Severity score: 8
Project: https://github.com/OpenMage/magento-lts
Published: 2020-08-19
File: app/code/core/Mage/Adminhtml/Controller/Action.php
Commit message: Merge pull request from GHSA-crf2-xm6x-46p6
Commit author: Daniel Fahlke

Vulnerable version (before fix):
 protected function _validateSecretKey()         }          if (!($secretKey = $this->getRequest()->getParam(Mage_Adminhtml_Model_Url::SECRET_KEY_PARAM_NAME, null))             || $secretKey != Mage::getSingleton('adminhtml/url')->getSecretKey()) {             return false;         }         return true;

Fixed version (after fix):
 protected function _validateSecretKey()         }          if (!($secretKey = $this->getRequest()->getParam(Mage_Adminhtml_Model_Url::SECRET_KEY_PARAM_NAME, null))             || !hash_equals(Mage::getSingleton('adminhtml/url')->getSecretKey(), $secretKey)) {             return false;         }         return true;

Patch:
patch: @@ -389,7 +389,7 @@ protected function _validateSecretKey()
         }
 
         if (!($secretKey = $this->getRequest()->getParam(Mage_Adminhtml_Model_Url::SECRET_KEY_PARAM_NAME, null))
-            || $secretKey != Mage::getSingleton('adminhtml/url')->getSecretKey()) {
+            || !hash_equals(Mage::getSingleton('adminhtml/url')->getSecretKey(), $secretKey)) {
             return false;
         }
         return true;
path: app/code/core/Mage/Adminhtml/Controller/Action.php
Vulnerability: Regular Expression Denial of Service (ReDoS) in braces A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Vulnerability ID: GHSA-cwfw-4gq5-mrqx
CWE: CWE-400
Severity score: 0
Project: https://github.com/micromatch/braces
Published: 2022-01-06
File: lib/parsers.js
Commit message: optimize regex
Commit author: jonschlinkert

Vulnerable version (before fix):
 module.exports = function(braces, options) {     .set('multiplier', function() {       var isInside = this.isInside('brace');       var pos = this.position();       var m = this.match(/^\{(,+(?:(\{,+\})*),*|,*(?:(\{,+\})*),+)\}/);       if (!m) return;        this.multiplier = true;

Fixed version (after fix):
 module.exports = function(braces, options) {     .set('multiplier', function() {       var isInside = this.isInside('brace');       var pos = this.position();       var m = this.match(/^\{((?:,|\{,+\})+)\}/);       if (!m) return;        this.multiplier = true;

Patch:
patch: @@ -127,7 +127,7 @@ module.exports = function(braces, options) {
     .set('multiplier', function() {
       var isInside = this.isInside('brace');
       var pos = this.position();
-      var m = this.match(/^\{(,+(?:(\{,+\})*),*|,*(?:(\{,+\})*),+)\}/);
+      var m = this.match(/^\{((?:,|\{,+\})+)\}/);
       if (!m) return;
 
       this.multiplier = true;
path: lib/parsers.js
Vulnerability: Stored XSS with custom URLs in PrestaShop module ps_linklist ### Impact
Stored XSS when using custom URLs.

### Patches
The problem is fixed in 3.1.0

### References
[Cross-site Scripting (XSS) - Stored (CWE-79)](https://cwe.mitre.org/data/definitions/79.html)
Vulnerability ID: GHSA-cx2r-mf6x-55rx
CWE: CWE-79
Severity score: 4.1
Project: https://github.com/PrestaShop/ps_linklist
Published: 2021-10-12
File: src/Form/Type/CustomUrlType.php
Commit message: Merge pull request from GHSA-cx2r-mf6x-55rx

The custom url field must be a valid url
Commit author: GoT

Vulnerable version (before fix):
 use PrestaShopBundle\Form\Admin\Type\TranslatorAwareType; use Symfony\Component\Form\Extension\Core\Type\TextType; use Symfony\Component\Form\FormBuilderInterface;  class CustomUrlType extends TranslatorAwareType { public function buildForm(FormBuilderInterface $builder, array $options)             ->add('url', TextType::class, [                 'label' => $this->trans('URL', 'Modules.Linklist.Admin'),                 'required' => true,             ])         ;     }

Fixed version (after fix):
 use PrestaShopBundle\Form\Admin\Type\TranslatorAwareType; use Symfony\Component\Form\Extension\Core\Type\TextType; use Symfony\Component\Form\FormBuilderInterface; use Symfony\Component\Validator\Constraints as Assert;  class CustomUrlType extends TranslatorAwareType { public function buildForm(FormBuilderInterface $builder, array $options)             ->add('url', TextType::class, [                 'label' => $this->trans('URL', 'Modules.Linklist.Admin'),                 'required' => true,                 'constraints' => [new Assert\Url()],             ])         ;     }

Patch:
patch: @@ -29,6 +29,7 @@
 use PrestaShopBundle\Form\Admin\Type\TranslatorAwareType;
 use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Validator\Constraints as Assert;
 
 class CustomUrlType extends TranslatorAwareType
 {
@@ -45,6 +46,7 @@ public function buildForm(FormBuilderInterface $builder, array $options)
             ->add('url', TextType::class, [
                 'label' => $this->trans('URL', 'Modules.Linklist.Admin'),
                 'required' => true,
+                'constraints' => [new Assert\Url()],
             ])
         ;
     }
path: src/Form/Type/CustomUrlType.php
Vulnerability: Data races in libsbc Affected versions of this crate implements `Send` for `Decoder<R>` for any `R: Read`. This allows `Decoder<R>` to contain `R: !Send` and carry (move) it to another thread.

This can result in undefined behavior such as memory corruption from data race on `R`, or dropping `R = MutexGuard<_>` from a thread that didn't lock the mutex.

The flaw was corrected in commit a34d6e1 by adding trait bound `R: Send` to the `Send` impl for `Decoder<R>`.
Vulnerability ID: GHSA-f6g6-54hm-fhxv
CWE: CWE-362
Severity score: 8.1
Project: https://github.com/mvertescher/libsbc-rs
Published: 2021-08-25
File: src/lib.rs
Commit message: Add R: Send bound to Send impl of Decoder<R>
fixes issue #4
Commit author: JOE1994

Vulnerable version (before fix):
 where  unsafe impl<R> Send for Decoder<R> where         R: Read, { } 

Fixed version (after fix):
 where  unsafe impl<R> Send for Decoder<R> where         R: Read + Send, { } 

Patch:
patch: @@ -33,7 +33,7 @@ where
 
 unsafe impl<R> Send for Decoder<R>
 where
-        R: Read,
+        R: Read + Send,
 {
 }
path: src/lib.rs
Vulnerability: Data races in libsbc Affected versions of this crate implements `Send` for `Decoder<R>` for any `R: Read`. This allows `Decoder<R>` to contain `R: !Send` and carry (move) it to another thread.

This can result in undefined behavior such as memory corruption from data race on `R`, or dropping `R = MutexGuard<_>` from a thread that didn't lock the mutex.

The flaw was corrected in commit a34d6e1 by adding trait bound `R: Send` to the `Send` impl for `Decoder<R>`.
Vulnerability ID: GHSA-f6g6-54hm-fhxv
CWE: CWE-119
Severity score: 8.1
Project: https://github.com/mvertescher/libsbc-rs
Published: 2021-08-25
File: src/lib.rs
Commit message: Add R: Send bound to Send impl of Decoder<R>
fixes issue #4
Commit author: JOE1994

Vulnerable version (before fix):
 where  unsafe impl<R> Send for Decoder<R> where         R: Read, { } 

Fixed version (after fix):
 where  unsafe impl<R> Send for Decoder<R> where         R: Read + Send, { } 

Patch:
patch: @@ -33,7 +33,7 @@ where
 
 unsafe impl<R> Send for Decoder<R>
 where
-        R: Read,
+        R: Read + Send,
 {
 }
path: src/lib.rs
Vulnerability: Data race in Beego The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
Vulnerability ID: GHSA-f6px-w8rh-7r89
CWE: CWE-362
Severity score: 4.7
Project: https://github.com/beego/beego
Published: 2021-08-02
File: session/sess_file.go
Commit message: Change permission mask
Commit author: Nico Waisman

Vulnerable version (before fix):
 func (fp *FileProvider) SessionRead(sid string) (Store, error) { 	filepder.lock.Lock() 	defer filepder.lock.Unlock()  	err := os.MkdirAll(path.Join(fp.savePath, string(sid[0]), string(sid[1])), 0777) 	if err != nil { 		SLogger.Println(err.Error()) 	} func (fp *FileProvider) SessionRegenerate(oldsid, sid string) (Store, error) { 		return nil, fmt.Errorf("newsid %s exist", newSidFile) 	}  	err = os.MkdirAll(newPath, 0777) 	if err != nil { 		SLogger.Println(err.Error()) 	}

Fixed version (after fix):
 func (fp *FileProvider) SessionRead(sid string) (Store, error) { 	filepder.lock.Lock() 	defer filepder.lock.Unlock()  	err := os.MkdirAll(path.Join(fp.savePath, string(sid[0]), string(sid[1])), 0755) 	if err != nil { 		SLogger.Println(err.Error()) 	} func (fp *FileProvider) SessionRegenerate(oldsid, sid string) (Store, error) { 		return nil, fmt.Errorf("newsid %s exist", newSidFile) 	}  	err = os.MkdirAll(newPath, 0755) 	if err != nil { 		SLogger.Println(err.Error()) 	}

Patch:
patch: @@ -138,7 +138,7 @@ func (fp *FileProvider) SessionRead(sid string) (Store, error) {
 	filepder.lock.Lock()
 	defer filepder.lock.Unlock()
 
-	err := os.MkdirAll(path.Join(fp.savePath, string(sid[0]), string(sid[1])), 0777)
+	err := os.MkdirAll(path.Join(fp.savePath, string(sid[0]), string(sid[1])), 0755)
 	if err != nil {
 		SLogger.Println(err.Error())
 	}
@@ -231,7 +231,7 @@ func (fp *FileProvider) SessionRegenerate(oldsid, sid string) (Store, error) {
 		return nil, fmt.Errorf("newsid %s exist", newSidFile)
 	}
 
-	err = os.MkdirAll(newPath, 0777)
+	err = os.MkdirAll(newPath, 0755)
 	if err != nil {
 		SLogger.Println(err.Error())
 	}
path: session/sess_file.go
Vulnerability: Improper Input Validation in Jenkins Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092. The fix for that vulnerability has been backported to the version of the library bundled with Jenkins.
Vulnerability ID: GHSA-f7f6-xrwc-9c57
CWE: CWE-20
Severity score: 7.5
Project: https://github.com/jenkinsci/jenkins
Published: 2022-05-14
File: core/pom.xml
Commit message: [SECURITY-490] Patch Commons File Upload 1.3.x.
Commit author: Jesse Glick

Vulnerable version (before fix):
 THE SOFTWARE.     <dependency>       <groupId>commons-fileupload</groupId>       <artifactId>commons-fileupload</artifactId>       <version>1.3.1-jenkins-1</version>     </dependency>      <!-- offline profiler API to put in the classpath if we need it -->

Fixed version (after fix):
 THE SOFTWARE.     <dependency>       <groupId>commons-fileupload</groupId>       <artifactId>commons-fileupload</artifactId>       <version>1.3.1-jenkins-2</version>      </dependency>      <!-- offline profiler API to put in the classpath if we need it -->

Patch:
patch: @@ -588,7 +588,7 @@ THE SOFTWARE.
     <dependency>
       <groupId>commons-fileupload</groupId>
       <artifactId>commons-fileupload</artifactId>
-      <version>1.3.1-jenkins-1</version>
+      <version>1.3.1-jenkins-2</version> 
     </dependency>
 
     <!-- offline profiler API to put in the classpath if we need it -->
path: core/pom.xml