rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Cross site scripting in reveal.js The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input to parts using which attacker can execute arbitrary javascript code on victim's browser window hosting reveal.js
Vulnerability ID: GHSA-hhqj-cfjx-vj25
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/hakimel/reveal.js
Published: 2022-03-02
File: plugin/notes/speaker-view.html
Commit message: Fix DOM XSS
Commit author: r0hanSH

Vulnerable version (before fix):
 <h4 class="label">Notes</h4>  				window.addEventListener( 'message', function( event ) {  					clearTimeout( connectionTimeout ); 					connectionStatus.style.display = 'none'; 

Fixed version (after fix):
 <h4 class="label">Notes</h4>  				window.addEventListener( 'message', function( event ) {  					if (window.location.origin !== event.origin){ 						return; 					}  					clearTimeout( connectionTimeout ); 					connectionStatus.style.display = 'none'; 

Patch:
patch: @@ -368,6 +368,10 @@ <h4 class="label">Notes</h4>
 
 				window.addEventListener( 'message', function( event ) {
 
+					if (window.location.origin !== event.origin){
+						return;
+					}
+
 					clearTimeout( connectionTimeout );
 					connectionStatus.style.display = 'none';
path: plugin/notes/speaker-view.html
Vulnerability: Regular expression deinal of service in py A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.
Vulnerability ID: GHSA-hj5v-574p-mj7c
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/pytest-dev/py
Published: 2021-04-20
File: py/_path/svnwc.py
Commit message: svnwc: fix regular expression vulnerable to DoS in blame functionality

The subpattern `\d+\s*\S+` is ambiguous which makes the pattern subject
to catastrophic backtracing given a string like `"1" * 5000`.

SVN blame output seems to always have at least one space between the
revision number and the user name, so the ambiguity can be fixed by
changing the `*` to `+`.

Fixes #256.
Commit author: Ran Benita

Vulnerable version (before fix):
 def makecmdoptions(self):     def __str__(self):         return "<SvnAuth username=%s ...>" %(self.username,)  rex_blame = re.compile(r'\s*(\d+)\s*(\S+) (.*)')  class SvnWCCommandPath(common.PathBase):     """ path implementation offering access/modification to svn working copies.

Fixed version (after fix):
 def makecmdoptions(self):     def __str__(self):         return "<SvnAuth username=%s ...>" %(self.username,)  rex_blame = re.compile(r'\s*(\d+)\s+(\S+) (.*)')  class SvnWCCommandPath(common.PathBase):     """ path implementation offering access/modification to svn working copies.

Patch:
patch: @@ -396,7 +396,7 @@ def makecmdoptions(self):
     def __str__(self):
         return "<SvnAuth username=%s ...>" %(self.username,)
 
-rex_blame = re.compile(r'\s*(\d+)\s*(\S+) (.*)')
+rex_blame = re.compile(r'\s*(\d+)\s+(\S+) (.*)')
 
 class SvnWCCommandPath(common.PathBase):
     """ path implementation offering access/modification to svn working copies.
path: py/_path/svnwc.py
Vulnerability: Cross-site Scripting in Microweber Microweber prior to version 1.3 is vulnerable to reflected cross-site scripting.
Vulnerability ID: GHSA-hj8g-cw8x-2c6m
CWE: CWE-79
Severity score: 7.6
Project: https://github.com/microweber/microweber
Published: 2022-02-24
File: src/MicroweberPackages/Helper/UrlManager.php
Commit message: Update UrlManager.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 public function string($skip_ajax = false)          // clear request params         $cleanParam = new HTMLClean();         $u1 = $cleanParam->cleanArray($u1);          return $u1;     }

Fixed version (after fix):
 public function string($skip_ajax = false)          // clear request params         $cleanParam = new HTMLClean();         $u1 = $cleanParam->clean($u1);           return $u1;     }

Patch:
patch: @@ -276,7 +276,8 @@ public function string($skip_ajax = false)
 
         // clear request params
         $cleanParam = new HTMLClean();
-        $u1 = $cleanParam->cleanArray($u1);
+        $u1 = $cleanParam->clean($u1);
+
 
         return $u1;
     }
path: src/MicroweberPackages/Helper/UrlManager.php
Vulnerability: Stored cross-site scripting in Snipe-IT Snipe-IT prior to version 5.4.3 is vulnerable to stored cross-site scripting because the input to the `checked_out_to` parameter is not escaped. The vulnerability is capable of stealing a user's cookie.
Vulnerability ID: GHSA-hpx4-xjp7-m4vr
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/snipe/snipe-it
Published: 2022-04-25
File: app/Http/Transformers/DepreciationReportTransformer.php
Commit message: Escape checkout target name

Signed-off-by: snipe <snipe@snipe.net>
Commit author: snipe

Vulnerable version (before fix):
 public function transformAsset(Asset $asset)             'purchase_cost' => Helper::formatCurrencyOutput($asset->purchase_cost),             'book_value' => Helper::formatCurrencyOutput($depreciated_value),             'monthly_depreciation' => $monthly_depreciation,             'checked_out_to' => $checkout_target,             'diff' =>  Helper::formatCurrencyOutput($diff),             'number_of_months' =>  ($asset->model && $asset->model->depreciation) ? e($asset->model->depreciation->months) : null,             'depreciation' => (($asset->model) && ($asset->model->depreciation)) ?  e($asset->model->depreciation->name) : null,

Fixed version (after fix):
 public function transformAsset(Asset $asset)             'purchase_cost' => Helper::formatCurrencyOutput($asset->purchase_cost),             'book_value' => Helper::formatCurrencyOutput($depreciated_value),             'monthly_depreciation' => $monthly_depreciation,             'checked_out_to' => ($checkout_target) ? e($checkout_target) : null,             'diff' =>  Helper::formatCurrencyOutput($diff),             'number_of_months' =>  ($asset->model && $asset->model->depreciation) ? e($asset->model->depreciation->months) : null,             'depreciation' => (($asset->model) && ($asset->model->depreciation)) ?  e($asset->model->depreciation->name) : null,

Patch:
patch: @@ -98,7 +98,7 @@ public function transformAsset(Asset $asset)
             'purchase_cost' => Helper::formatCurrencyOutput($asset->purchase_cost),
             'book_value' => Helper::formatCurrencyOutput($depreciated_value),
             'monthly_depreciation' => $monthly_depreciation,
-            'checked_out_to' => $checkout_target,
+            'checked_out_to' => ($checkout_target) ? e($checkout_target) : null,
             'diff' =>  Helper::formatCurrencyOutput($diff),
             'number_of_months' =>  ($asset->model && $asset->model->depreciation) ? e($asset->model->depreciation->months) : null,
             'depreciation' => (($asset->model) && ($asset->model->depreciation)) ?  e($asset->model->depreciation->name) : null,
path: app/Http/Transformers/DepreciationReportTransformer.php
Vulnerability: Denial of service in microweber Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The post title input can be limited to 500 characters or max 1000 characters as a workaround.
Vulnerability ID: GHSA-hrf4-hcpc-3345
CWE: CWE-190
Severity score: 7.1
Project: https://github.com/microweber/microweber
Published: 2022-03-16
File: src/MicroweberPackages/Post/Http/Requests/PostRequest.php
Commit message: Update PostRequest.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 public function authorize()      */     public function rules()     {         $rules = [            // 'title' => 'required', // todo with multilanguage         ];          return $rules;

Fixed version (after fix):
 public function authorize()      */     public function rules()     {         // todo with multilanguage          $rules = [             'title' => 'required|max:500',             'url' => 'max:500',             'description' => 'max:500',             'content_meta_title' => 'max:500',             'content_meta_keywords' => 'max:500',             'original_link' => 'max:500',         ];          return $rules;

Patch:
patch: @@ -22,8 +22,15 @@ public function authorize()
      */
     public function rules()
     {
+        // todo with multilanguage
+
         $rules = [
-           // 'title' => 'required', // todo with multilanguage
+            'title' => 'required|max:500',
+            'url' => 'max:500',
+            'description' => 'max:500',
+            'content_meta_title' => 'max:500',
+            'content_meta_keywords' => 'max:500',
+            'original_link' => 'max:500',
         ];
 
         return $rules;
path: src/MicroweberPackages/Post/Http/Requests/PostRequest.php
Vulnerability: Integer overflow discovered in Pillow  Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
Vulnerability ID: GHSA-hvr8-466p-75rh
CWE: CWE-119
Severity score: 9.8
Project: https://github.com/python-pillow/Pillow
Published: 2018-07-24
File: libImaging/Resample.c
Commit message: fix integer overflow in Resample.c
Commit author: Ned Williamson

Vulnerable version (before fix):
 ImagingResampleHorizontal(Imaging imIn, int xsize, int filter)     /* maximum number of coofs */     kmax = (int) ceil(support) * 2 + 1;      /* coefficient buffer */     kk = malloc(xsize * kmax * sizeof(float));     if ( ! kk)         return (Imaging) ImagingError_MemoryError();      xbounds = malloc(xsize * 2 * sizeof(int));     if ( ! xbounds) {         free(kk);

Fixed version (after fix):
 ImagingResampleHorizontal(Imaging imIn, int xsize, int filter)     /* maximum number of coofs */     kmax = (int) ceil(support) * 2 + 1;      // check for overflow     if (kmax > 0 && xsize > SIZE_MAX / kmax)         return (Imaging) ImagingError_MemoryError();      // sizeof(float) should be greater than 0     if (xsize * kmax > SIZE_MAX / sizeof(float))         return (Imaging) ImagingError_MemoryError();      /* coefficient buffer */     kk = malloc(xsize * kmax * sizeof(float));     if ( ! kk)         return (Imaging) ImagingError_MemoryError();      // sizeof(int) should be greater than 0 as well     if (xsize > SIZE_MAX / (2 * sizeof(int)))         return (Imaging) ImagingError_MemoryError();      xbounds = malloc(xsize * 2 * sizeof(int));     if ( ! xbounds) {         free(kk);

Patch:
patch: @@ -138,11 +138,23 @@ ImagingResampleHorizontal(Imaging imIn, int xsize, int filter)
     /* maximum number of coofs */
     kmax = (int) ceil(support) * 2 + 1;
 
+    // check for overflow
+    if (kmax > 0 && xsize > SIZE_MAX / kmax)
+        return (Imaging) ImagingError_MemoryError();
+
+    // sizeof(float) should be greater than 0
+    if (xsize * kmax > SIZE_MAX / sizeof(float))
+        return (Imaging) ImagingError_MemoryError();
+
     /* coefficient buffer */
     kk = malloc(xsize * kmax * sizeof(float));
     if ( ! kk)
         return (Imaging) ImagingError_MemoryError();
 
+    // sizeof(int) should be greater than 0 as well
+    if (xsize > SIZE_MAX / (2 * sizeof(int)))
+        return (Imaging) ImagingError_MemoryError();
+
     xbounds = malloc(xsize * 2 * sizeof(int));
     if ( ! xbounds) {
         free(kk);
path: libImaging/Resample.c
Vulnerability: Cross-site Scripting in librenms Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
Vulnerability ID: GHSA-hxmr-5gv9-6p8v
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/librenms/librenms
Published: 2022-02-15
File: includes/html/pages/addhost.inc.php
Commit message: XSS fix, cont. (#13776)

https://huntr.dev/bounties/13951f51-deed-4a3d-8275-52306cc5a87d/
Commit author: PipoCanaja

Vulnerable version (before fix):
             $snmpver = 'v2c';             $additional = [                 'snmp_disable' => 1,                 'os'           => $_POST['os'] ? $_POST['os_id'] : 'ping',                 'hardware'     => $_POST['hardware'],                 'sysName'      => $_POST['sysName'],             ];         } elseif ($_POST['snmpver'] === 'v2c' || $_POST['snmpver'] === 'v1') {             if ($_POST['community']) {

Fixed version (after fix):
             $snmpver = 'v2c';             $additional = [                 'snmp_disable' => 1,                 'os'           => $_POST['os'] ? strip_tags($_POST['os_id']) : 'ping',                 'hardware'     => strip_tags($_POST['hardware']),                 'sysName'      => strip_tags($_POST['sysName']),             ];         } elseif ($_POST['snmpver'] === 'v2c' || $_POST['snmpver'] === 'v1') {             if ($_POST['community']) {

Patch:
patch: @@ -45,9 +45,9 @@
             $snmpver = 'v2c';
             $additional = [
                 'snmp_disable' => 1,
-                'os'           => $_POST['os'] ? $_POST['os_id'] : 'ping',
-                'hardware'     => $_POST['hardware'],
-                'sysName'      => $_POST['sysName'],
+                'os'           => $_POST['os'] ? strip_tags($_POST['os_id']) : 'ping',
+                'hardware'     => strip_tags($_POST['hardware']),
+                'sysName'      => strip_tags($_POST['sysName']),
             ];
         } elseif ($_POST['snmpver'] === 'v2c' || $_POST['snmpver'] === 'v1') {
             if ($_POST['community']) {
path: includes/html/pages/addhost.inc.php
Vulnerability: Resource exhaustion in engine.io  Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
Vulnerability ID: GHSA-j4f2-536g-r55m
CWE: CWE-400
Severity score: 7.5
Project: https://github.com/socketio/engine.io
Published: 2022-02-09
File: lib/server.js
Commit message: feat: decrease the default value of maxHttpBufferSize

This change reduces the default value from 100 mb to a more sane 1 mb.

This helps protect the server against denial of service attacks by
malicious clients sending huge amounts of data.
Commit author: Damien Arrachequesne

Vulnerable version (before fix):
 class Server extends EventEmitter {         pingTimeout: 5000,         pingInterval: 25000,         upgradeTimeout: 10000,         maxHttpBufferSize: 10e7,         transports: Object.keys(transports),         allowUpgrades: true,         perMessageDeflate: {

Fixed version (after fix):
 class Server extends EventEmitter {         pingTimeout: 5000,         pingInterval: 25000,         upgradeTimeout: 10000,         maxHttpBufferSize: 1e6,         transports: Object.keys(transports),         allowUpgrades: true,         perMessageDeflate: {

Patch:
patch: @@ -26,7 +26,7 @@ class Server extends EventEmitter {
         pingTimeout: 5000,
         pingInterval: 25000,
         upgradeTimeout: 10000,
-        maxHttpBufferSize: 10e7,
+        maxHttpBufferSize: 1e6,
         transports: Object.keys(transports),
         allowUpgrades: true,
         perMessageDeflate: {
path: lib/server.js
Vulnerability: Cross-Site Scripting in backbone Affected versions of `backbone` are vulnerable to cross-site scripting when users are allowed to supply input to the `Model#Escape` function, and the output is then written to the DOM. 

The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as `&#60;` into account.


## Recommendation

Update to version 0.5.0 or later.
Vulnerability ID: GHSA-j6p2-cx3w-6jcp
CWE: CWE-79
Severity score: 0
Project: https://github.com/jashkenas/backbone
Published: 2019-02-18
File: backbone.js
Commit message: Fixed escapeHTML function
to skip not only &***;, but also &#***; and &x***;
Commit author: Dmitry Baranovskiy

Vulnerable version (before fix):
    // Helper function to escape a string for HTML rendering.   var escapeHTML = function(string) {     return string.replace(/&(?!\w+;)/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');   };  }).call(this);

Fixed version (after fix):
    // Helper function to escape a string for HTML rendering.   var escapeHTML = function(string) {     return string.replace(/&(?!\w+;|#\d+;|#x[\da-f]+;)/gi, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');   };  }).call(this);

Patch:
patch: @@ -1079,7 +1079,7 @@
 
   // Helper function to escape a string for HTML rendering.
   var escapeHTML = function(string) {
-    return string.replace(/&(?!\w+;)/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+    return string.replace(/&(?!\w+;|#\d+;|#x[\da-f]+;)/gi, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
   };
 
 }).call(this);
path: backbone.js
Vulnerability: Moderate severity vulnerability that affects kdcproxy python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.
Vulnerability ID: GHSA-j7c4-2xj8-wm7r
CWE: CWE-20
Severity score: 7.5
Project: https://github.com/latchset/kdcproxy
Published: 2018-11-01
File: kdcproxy/__init__.py
Commit message: Enforce a maximum packet length

Permanently fixes CVE-2015-5159 for all applications.
Commit author: Nathaniel McCallum

Vulnerable version (before fix):
 def __str__(self):   class Application:     SOCKTYPES = {         "tcp": socket.SOCK_STREAM,         "udp": socket.SOCK_DGRAM, def __call__(self, env, start_response):             try:                 length = int(env["CONTENT_LENGTH"])             except AttributeError:                 length = -1             try:                 pr = codec.decode(env["wsgi.input"].read(length))             except codec.ParsingError as e:

Fixed version (after fix):
 def __str__(self):   class Application:     MAX_LENGTH = 128 * 1024     SOCKTYPES = {         "tcp": socket.SOCK_STREAM,         "udp": socket.SOCK_DGRAM, def __call__(self, env, start_response):             try:                 length = int(env["CONTENT_LENGTH"])             except AttributeError:                 raise HTTPException(411, "Length required.")             if length < 0:                 raise HTTPException(411, "Length required.")             if length > self.MAX_LENGTH:                 raise HTTPException(413, "Request entity too large.")             try:                 pr = codec.decode(env["wsgi.input"].read(length))             except codec.ParsingError as e:

Patch:
patch: @@ -61,6 +61,7 @@ def __str__(self):
 
 
 class Application:
+    MAX_LENGTH = 128 * 1024
     SOCKTYPES = {
         "tcp": socket.SOCK_STREAM,
         "udp": socket.SOCK_DGRAM,
@@ -180,7 +181,11 @@ def __call__(self, env, start_response):
             try:
                 length = int(env["CONTENT_LENGTH"])
             except AttributeError:
-                length = -1
+                raise HTTPException(411, "Length required.")
+            if length < 0:
+                raise HTTPException(411, "Length required.")
+            if length > self.MAX_LENGTH:
+                raise HTTPException(413, "Request entity too large.")
             try:
                 pr = codec.decode(env["wsgi.input"].read(length))
             except codec.ParsingError as e:
path: kdcproxy/__init__.py
Vulnerability: Division by zero in TFLite's implementation of `SpaceToDepth` ### Impact
The `Prepare` step of the `SpaceToDepth` TFLite operator [does not check for 0 before division](https://github.com/tensorflow/tensorflow/blob/5f7975d09eac0f10ed8a17dbb6f5964977725adc/tensorflow/lite/kernels/space_to_depth.cc#L63-L67).

```cc 
const int block_size = params->block_size;
const int input_height = input->dims->data[1];
const int input_width = input->dims->data[2];
int output_height = input_height / block_size;
int output_width = input_width / block_size;
```   

An attacker can craft a model such that `params->block_size` would be zero.

### Patches
We have patched the issue in GitHub commit [0d45ea1ca641b21b73bcf9c00e0179cda284e7e7](https://github.com/tensorflow/tensorflow/commit/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability ID: GHSA-j7rm-8ww4-xx2g
CWE: CWE-369
Severity score: 2.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-05-21
File: tensorflow/lite/kernels/space_to_depth.cc
Commit message: Prevent one more div by 0 in TFLite

PiperOrigin-RevId: 370800114
Change-Id: I6b956aeb8c458cc6f514408d2e89ffacfe249e57
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {   TF_LITE_ENSURE_TYPES_EQ(context, input->type, output->type);    const int block_size = params->block_size;   const int input_height = input->dims->data[1];   const int input_width = input->dims->data[2];   int output_height = input_height / block_size;

Fixed version (after fix):
 TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {   TF_LITE_ENSURE_TYPES_EQ(context, input->type, output->type);    const int block_size = params->block_size;   TF_LITE_ENSURE(context, block_size > 0);   const int input_height = input->dims->data[1];   const int input_width = input->dims->data[2];   int output_height = input_height / block_size;

Patch:
patch: @@ -61,6 +61,7 @@ TfLiteStatus Prepare(TfLiteContext* context, TfLiteNode* node) {
   TF_LITE_ENSURE_TYPES_EQ(context, input->type, output->type);
 
   const int block_size = params->block_size;
+  TF_LITE_ENSURE(context, block_size > 0);
   const int input_height = input->dims->data[1];
   const int input_width = input->dims->data[2];
   int output_height = input_height / block_size;
path: tensorflow/lite/kernels/space_to_depth.cc
Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV OpenCV 3.3.1 (corresponding with opencv-python and opencv-contrib-python 3.3.1.11) has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.
Vulnerability ID: GHSA-jcxv-2j3h-mg59
CWE: CWE-119
Severity score: 6.5
Project: https://github.com/opencv/opencv
Published: 2021-10-12
File: modules/imgcodecs/src/grfmt_pxm.cpp
Commit message: imgcodecs(pxm): fix memcpy size
Commit author: Alexander Alekhin

Vulnerable version (before fix):
 bool PxMDecoder::readData( Mat& img )                         }                     }                     else                         memcpy( data, src, CV_ELEM_SIZE1(m_type)*m_width);                 }                 else                 {

Fixed version (after fix):
 bool PxMDecoder::readData( Mat& img )                         }                     }                     else                         memcpy(data, src, img.elemSize1()*m_width);                 }                 else                 {

Patch:
patch: @@ -333,7 +333,7 @@ bool PxMDecoder::readData( Mat& img )
                         }
                     }
                     else
-                        memcpy( data, src, CV_ELEM_SIZE1(m_type)*m_width);
+                        memcpy(data, src, img.elemSize1()*m_width);
                 }
                 else
                 {
path: modules/imgcodecs/src/grfmt_pxm.cpp