rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Cross-Site Scripting in TYPO3's Frontend Login Mailer > ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9)

### Problem
User submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages.

### Solution
Update to TYPO3 versions 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

### Credits
Thanks to Christian Seifert who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.

### References
* [TYPO3-CORE-SA-2022-004](https://typo3.org/security/advisory/typo3-core-sa-2022-004)
Vulnerability ID: GHSA-h4mx-xv96-2jgm
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/TYPO3/typo3
Published: 2022-06-17
File: typo3/sysext/felogin/Resources/Private/Email/Templates/PasswordRecovery.html
Commit message: [SECURITY] Avoid HTML injection in password recovery mail

The `receiverName` variable used in the password recovery mail of the
Extbase felogin plugin was susceptible to HTML injection due to
missing sanitization. The variable is now passed thru the
`f:format.htmlspecialchars` ViewHelper.

Resolves: #96559
Releases: main, 11.5, 10.4
Change-Id: I60e23c161f7f2fcc87b8870345b10a4c31d7b8db
Security-Bulletin: TYPO3-CORE-SA-2022-004
Security-References: CVE-2022-31049
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74904
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Commit author: Andreas Fernandez

Vulnerable version (before fix):
         {f:translate(         key: 'forgot_validate_reset_password_html',         extensionName: 'felogin',         arguments: '{ 0: receiverName, 1: recoveryLink, 2: validUntil }'         ) -> f:format.html()}     </f:spaceless> </f:section>

Fixed version (after fix):
         {f:translate(         key: 'forgot_validate_reset_password_html',         extensionName: 'felogin',         arguments: '{ 0: "{receiverName -> f:format.htmlspecialchars()}", 1: recoveryLink, 2: validUntil }'         ) -> f:format.html()}     </f:spaceless> </f:section>

Patch:
patch: @@ -9,7 +9,7 @@
         {f:translate(
         key: 'forgot_validate_reset_password_html',
         extensionName: 'felogin',
-        arguments: '{ 0: receiverName, 1: recoveryLink, 2: validUntil }'
+        arguments: '{ 0: "{receiverName -> f:format.htmlspecialchars()}", 1: recoveryLink, 2: validUntil }'
         ) -> f:format.html()}
     </f:spaceless>
 </f:section>
path: typo3/sysext/felogin/Resources/Private/Email/Templates/PasswordRecovery.html
Vulnerability: Heap OOB read in TFLite ### Impact
A specially crafted TFLite model could trigger an OOB read on heap in the TFLite implementation of [`Split_V`](https://github.com/tensorflow/tensorflow/blob/c59c37e7b2d563967da813fa50fe20b21f4da683/tensorflow/lite/kernels/split_v.cc#L99):

```cc
const int input_size = SizeOfDimension(input, axis_value);
``` 

If `axis_value` is not a value between 0 and `NumDimensions(input)`, then the [`SizeOfDimension` function](https://github.com/tensorflow/tensorflow/blob/102b211d892f3abc14f845a72047809b39cc65ab/tensorflow/lite/kernels/kernel_util.h#L148-L150) will access data outside the bounds of the tensor shape array:

```cc
inline int SizeOfDimension(const TfLiteTensor* t, int dim) {
  return t->dims->data[dim];
}
```
  
### Patches 
We have patched the issue in GitHub commit [ae2daeb45abfe2c6dda539cf8d0d6f653d3ef412](https://github.com/tensorflow/tensorflow/commit/ae2daeb45abfe2c6dda539cf8d0d6f653d3ef412).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability ID: GHSA-h4pc-gx2w-f2xv
CWE: CWE-125
Severity score: 7.1
Project: https://github.com/tensorflow/tensorflow
Published: 2021-05-21
File: tensorflow/lite/kernels/split_v.cc
Commit message: Prevent array OOB read/write

PiperOrigin-RevId: 371026165
Change-Id: I26ac6372c87246e03c7eb8c94e84c84d86054b36
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 TfLiteStatus ResizeOutputTensors(TfLiteContext* context, TfLiteNode* node,     }   }    const int input_size = SizeOfDimension(input, axis_value);    if (minus_one_index != -1) {

Fixed version (after fix):
 TfLiteStatus ResizeOutputTensors(TfLiteContext* context, TfLiteNode* node,     }   }    TF_LITE_ENSURE(context, axis_value >= 0);   TF_LITE_ENSURE(context, axis_value < NumDimensions(input));   const int input_size = SizeOfDimension(input, axis_value);    if (minus_one_index != -1) {

Patch:
patch: @@ -96,6 +96,8 @@ TfLiteStatus ResizeOutputTensors(TfLiteContext* context, TfLiteNode* node,
     }
   }
 
+  TF_LITE_ENSURE(context, axis_value >= 0);
+  TF_LITE_ENSURE(context, axis_value < NumDimensions(input));
   const int input_size = SizeOfDimension(input, axis_value);
 
   if (minus_one_index != -1) {
path: tensorflow/lite/kernels/split_v.cc
Vulnerability: Missing validation causes denial of service via `DeleteSessionTensor` ### Impact
The implementation of [`tf.raw_ops.DeleteSessionTensor`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L128-L144) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

handle = tf.constant("[]", shape=[0], dtype=tf.string)
tf.raw_ops.DeleteSessionTensor(handle=handle)
```
  
The code assumes `handle` is a scalar but there is no validation for this:
  
```cc
    const Tensor& handle = ctx->input(0);
    const string& name = handle.scalar<tstring>()();
```

### Patches
We have patched the issue in GitHub commit [cff267650c6a1b266e4b4500f69fbc49cdd773c5](https://github.com/tensorflow/tensorflow/commit/cff267650c6a1b266e4b4500f69fbc49cdd773c5).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Vulnerability ID: GHSA-h5g4-ppwx-48q2
CWE: CWE-20
Severity score: 5.5
Project: https://github.com/tensorflow/tensorflow
Published: 2022-05-24
File: tensorflow/core/kernels/session_ops.cc
Commit message: Fix tf.raw_ops.DeleteSessionTensor vulnerability with invalid `handle`.

Check that `handle` input is actually a scalar before treating it as such.

PiperOrigin-RevId: 445228994
Commit author: Alan Liu

Vulnerable version (before fix):
 class DeleteSessionTensorOp : public OpKernel {    void Compute(OpKernelContext* ctx) override {     const Tensor& handle = ctx->input(0);     const string& name = handle.scalar<tstring>()();     auto session_state = ctx->session_state();     OP_REQUIRES(ctx, session_state != nullptr,

Fixed version (after fix):
 class DeleteSessionTensorOp : public OpKernel {    void Compute(OpKernelContext* ctx) override {     const Tensor& handle = ctx->input(0);     OP_REQUIRES(ctx, TensorShapeUtils::IsScalar(handle.shape()),                 errors::InvalidArgument("`handle` must be scalar"));     const string& name = handle.scalar<tstring>()();     auto session_state = ctx->session_state();     OP_REQUIRES(ctx, session_state != nullptr,

Patch:
patch: @@ -134,6 +134,8 @@ class DeleteSessionTensorOp : public OpKernel {
 
   void Compute(OpKernelContext* ctx) override {
     const Tensor& handle = ctx->input(0);
+    OP_REQUIRES(ctx, TensorShapeUtils::IsScalar(handle.shape()),
+                errors::InvalidArgument("`handle` must be scalar"));
     const string& name = handle.scalar<tstring>()();
     auto session_state = ctx->session_state();
     OP_REQUIRES(ctx, session_state != nullptr,
path: tensorflow/core/kernels/session_ops.cc
Vulnerability: Regular Expression Denial of Service (ReDoS) A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Vulnerability ID: GHSA-h6ch-v84p-w6p9
CWE: CWE-400
Severity score: 0
Project: https://github.com/kpdecker/jsdiff
Published: 2019-06-13
File: src/patch/parse.js
Commit message: Optimize parch header parser
Commit author: Kevin Decker

Vulnerable version (before fix):
 export function parsePatch(uniDiff, options = {}) {   // Parses the --- and +++ headers, if none are found, no lines   // are consumed.   function parseFileHeader(index) {     const headerPattern = /^(---|\+\+\+)\s+([\S ]*)(?:\t(.*?)\s*)?$/;     const fileHeader = headerPattern.exec(diffstr[i]);     if (fileHeader) {       let keyPrefix = fileHeader[1] === '---' ? 'old' : 'new';       let fileName = fileHeader[2].replace(/\\\\/g, '\\');       if (/^".*"$/.test(fileName)) {         fileName = fileName.substr(1, fileName.length - 2);       }       index[keyPrefix + 'FileName'] = fileName;       index[keyPrefix + 'Header'] = fileHeader[3];        i++;     }

Fixed version (after fix):
 export function parsePatch(uniDiff, options = {}) {   // Parses the --- and +++ headers, if none are found, no lines   // are consumed.   function parseFileHeader(index) {     const fileHeader = (/^(---|\+\+\+)\s+(.*)$/).exec(diffstr[i]);     if (fileHeader) {       let keyPrefix = fileHeader[1] === '---' ? 'old' : 'new';       const data = fileHeader[2].split('\t', 2);       let fileName = data[0].replace(/\\\\/g, '\\');       if (/^".*"$/.test(fileName)) {         fileName = fileName.substr(1, fileName.length - 2);       }       index[keyPrefix + 'FileName'] = fileName;       index[keyPrefix + 'Header'] = (data[1] || '').trim();        i++;     }

Patch:
patch: @@ -53,16 +53,16 @@ export function parsePatch(uniDiff, options = {}) {
   // Parses the --- and +++ headers, if none are found, no lines
   // are consumed.
   function parseFileHeader(index) {
-    const headerPattern = /^(---|\+\+\+)\s+([\S ]*)(?:\t(.*?)\s*)?$/;
-    const fileHeader = headerPattern.exec(diffstr[i]);
+    const fileHeader = (/^(---|\+\+\+)\s+(.*)$/).exec(diffstr[i]);
     if (fileHeader) {
       let keyPrefix = fileHeader[1] === '---' ? 'old' : 'new';
-      let fileName = fileHeader[2].replace(/\\\\/g, '\\');
+      const data = fileHeader[2].split('\t', 2);
+      let fileName = data[0].replace(/\\\\/g, '\\');
       if (/^".*"$/.test(fileName)) {
         fileName = fileName.substr(1, fileName.length - 2);
       }
       index[keyPrefix + 'FileName'] = fileName;
-      index[keyPrefix + 'Header'] = fileHeader[3];
+      index[keyPrefix + 'Header'] = (data[1] || '').trim();
 
       i++;
     }
path: src/patch/parse.js
Vulnerability: bson is vulnerable to denial of service due to incorrect regex validation BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.
Vulnerability ID: GHSA-h6rj-8r3c-9gpj
CWE: CWE-400
Severity score: 9.8
Project: https://github.com/mongodb/bson-ruby
Published: 2018-03-05
File: lib/bson/object_id.rb
Commit message: Use \A \z for checking regex on legal
Commit author: Durran Jordan

Vulnerable version (before fix):
 def from_time(time, options = {})       #       # @since 2.0.0       def legal?(string)         string.to_s =~ /^[0-9a-f]{24}$/i ? true : false       end        # Executes the provided block only if the size of the provided object is

Fixed version (after fix):
 def from_time(time, options = {})       #       # @since 2.0.0       def legal?(string)         string.to_s =~ /\A[0-9a-f]{24}\z/i ? true : false       end        # Executes the provided block only if the size of the provided object is

Patch:
patch: @@ -282,7 +282,7 @@ def from_time(time, options = {})
       #
       # @since 2.0.0
       def legal?(string)
-        string.to_s =~ /^[0-9a-f]{24}$/i ? true : false
+        string.to_s =~ /\A[0-9a-f]{24}\z/i ? true : false
       end
 
       # Executes the provided block only if the size of the provided object is
path: lib/bson/object_id.rb
Vulnerability: Cross site scripting in facturascripts A Cross-site Scripting (XSS) vulnerability exists in the fsNick parameter in facturascripts prior to version 2022.06
Vulnerability ID: GHSA-h6wm-mr85-4h9g
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/neorazorx/facturascripts
Published: 2022-06-14
File: Core/App/AppController.php
Commit message: Sanitized username when showing user not found message.
------
Saneado nombre de usuario al mostrar el mensaje de usuario no encontrado.
Commit author: Carlos Garcia Gomez

Vulnerable version (before fix):
 private function userAuth()         }          $this->ipWarning();         ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => $nick]);         return false;     } 

Fixed version (after fix):
 private function userAuth()         }          $this->ipWarning();         ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => htmlspecialchars($nick)]);         return false;     } 

Patch:
patch: @@ -287,7 +287,7 @@ private function userAuth()
         }
 
         $this->ipWarning();
-        ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => $nick]);
+        ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => htmlspecialchars($nick)]);
         return false;
     }
path: Core/App/AppController.php
Vulnerability: Cross-Site Request Forgery (CSRF) in trestle-auth ### Impact
A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.

### Patches
The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [trestle-auth](https://github.com/TrestleAdmin/trestle-auth/issues)
* Email the maintainer at [sam@sampohlenz.com](mailto:sam@sampohlenz.com)
Vulnerability ID: GHSA-h8hx-2c5r-32cf
CWE: CWE-352
Severity score: 8.1
Project: https://github.com/TrestleAdmin/trestle-auth
Published: 2021-04-13
File: lib/trestle/auth/controller/authentication.rb
Commit message: Ensure CSRF protection is prepended before authentication before_actions
Commit author: Sam Pohlenz

Vulnerable version (before fix):
 module Authentication            prepend_before_action :require_authenticated_user           prepend_before_action :authenticate_user         end        protected

Fixed version (after fix):
 module Authentication            prepend_before_action :require_authenticated_user           prepend_before_action :authenticate_user            # Ensure that CSRF protection happens before authentication           protect_from_forgery prepend: true         end        protected

Patch:
patch: @@ -9,6 +9,9 @@ module Authentication
 
           prepend_before_action :require_authenticated_user
           prepend_before_action :authenticate_user
+
+          # Ensure that CSRF protection happens before authentication
+          protect_from_forgery prepend: true
         end
 
       protected
path: lib/trestle/auth/controller/authentication.rb
Vulnerability: Improper Input Validation in httpx Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
Vulnerability ID: GHSA-h8pj-cxx2-jfg2
CWE: CWE-20
Severity score: 9.1
Project: https://github.com/encode/httpx
Published: 2022-04-29
File: httpx/_urls.py
Commit message: Patch `copy_with`
Commit author: lebr0nli

Vulnerable version (before fix):
 def copy_with(self, **kwargs: typing.Any) -> "URL":         #  \_/   \______________/\_________/ \_________/ \__/         #   |           |            |            |        |         # scheme     authority       path        query   fragment         return URL(self._uri_reference.copy_with(**kwargs).unsplit())      def copy_set_param(self, key: str, value: typing.Any = None) -> "URL":         return self.copy_with(params=self.params.set(key, value))

Fixed version (after fix):
 def copy_with(self, **kwargs: typing.Any) -> "URL":         #  \_/   \______________/\_________/ \_________/ \__/         #   |           |            |            |        |         # scheme     authority       path        query   fragment         new_url = URL(self)         new_url._uri_reference = self._uri_reference.copy_with(**kwargs)         if new_url.is_absolute_url:             new_url._uri_reference = new_url._uri_reference.normalize()         return URL(new_url)      def copy_set_param(self, key: str, value: typing.Any = None) -> "URL":         return self.copy_with(params=self.params.set(key, value))

Patch:
patch: @@ -484,7 +484,11 @@ def copy_with(self, **kwargs: typing.Any) -> "URL":
         #  \_/   \______________/\_________/ \_________/ \__/
         #   |           |            |            |        |
         # scheme     authority       path        query   fragment
-        return URL(self._uri_reference.copy_with(**kwargs).unsplit())
+        new_url = URL(self)
+        new_url._uri_reference = self._uri_reference.copy_with(**kwargs)
+        if new_url.is_absolute_url:
+            new_url._uri_reference = new_url._uri_reference.normalize()
+        return URL(new_url)
 
     def copy_set_param(self, key: str, value: typing.Any = None) -> "URL":
         return self.copy_with(params=self.params.set(key, value))
path: httpx/_urls.py
Vulnerability: API token verification can be bypassed in NodeBB  ### Impact
Incorrect logic present in the token verification step unintentionally allowed master token access to the API.

### Patches
The vulnerability has been patch as of v1.18.5.

### Workarounds
Cherry-pick commit hash 04dab1d550cdebf4c1567bca9a51f8b9ca48a500 to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
Vulnerability ID: GHSA-hf2m-j98r-4fqw
CWE: CWE-287
Severity score: 9.8
Project: https://github.com/NodeBB/NodeBB
Published: 2021-11-30
File: src/routes/authentication.js
Commit message: fix: token verify
Commit author: Barış Soner Uşaklı

Vulnerable version (before fix):
 Auth.getLoginStrategies = function () { };  Auth.verifyToken = async function (token, done) { 	let { tokens = [] } = await meta.settings.get('core.api'); 	tokens = tokens.reduce((memo, cur) => { 		memo[cur.token] = cur.uid; 		return memo; 	}, {});  	const uid = tokens[token];  	if (uid !== undefined) { 		if (parseInt(uid, 10) > 0) {

Fixed version (after fix):
 Auth.getLoginStrategies = function () { };  Auth.verifyToken = async function (token, done) { 	const { tokens = [] } = await meta.settings.get('core.api'); 	const tokenObj = tokens.find(t => t.token === token); 	const uid = tokenObj ? tokenObj.uid : undefined;  	if (uid !== undefined) { 		if (parseInt(uid, 10) > 0) {

Patch:
patch: @@ -44,13 +44,9 @@ Auth.getLoginStrategies = function () {
 };
 
 Auth.verifyToken = async function (token, done) {
-	let { tokens = [] } = await meta.settings.get('core.api');
-	tokens = tokens.reduce((memo, cur) => {
-		memo[cur.token] = cur.uid;
-		return memo;
-	}, {});
-
-	const uid = tokens[token];
+	const { tokens = [] } = await meta.settings.get('core.api');
+	const tokenObj = tokens.find(t => t.token === token);
+	const uid = tokenObj ? tokenObj.uid : undefined;
 
 	if (uid !== undefined) {
 		if (parseInt(uid, 10) > 0) {
path: src/routes/authentication.js
Vulnerability: Unrestricted file upload leads to stored cross-site scripting in Microweber Microweber prior to version 1.2.12 allows unrestricted file upload, which could lead to stored cross-site scripting.
Vulnerability ID: GHSA-hf4q-52x6-4p57
CWE: CWE-79
Severity score: 4.8
Project: https://github.com/microweber/microweber
Published: 2022-03-11
File: src/MicroweberPackages/Utils/System/Files.php
Commit message: update
Commit author: Peter Ivanov

Vulnerable version (before fix):
 function get_dangerous_files_extentions()             'py',             'alfa',             'asp',             'htaccess',             'exe',             'msi',

Fixed version (after fix):
 function get_dangerous_files_extentions()             'py',             'alfa',             'asp',             'aspx',             'htaccess',             'exe',             'msi',

Patch:
patch: @@ -591,6 +591,7 @@ function get_dangerous_files_extentions()
             'py',
             'alfa',
             'asp',
+            'aspx',
             'htaccess',
             'exe',
             'msi',
path: src/MicroweberPackages/Utils/System/Files.php
Vulnerability: Sandbox Breakout / Arbitrary Code Execution in safer-eval Versions of `safer-eval` before 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.


## Recommendation

Upgrade to version 1.3.2.
Vulnerability ID: GHSA-hgch-jjmr-gp7w
CWE: CWE-94
Severity score: 9.9
Project: https://github.com/commenthol/safer-eval
Published: 2019-10-17
File: src/index.js
Commit message: fix: disallow usage of Object.constructor
Commit author: commenthol

Vulnerable version (before fix):
 class SaferEval {     if (typeof code !== 'string') {       throw new TypeError('not a string')     }     return vm.runInContext(       '(function () {"use strict"; return ' + code + '})()',       this._context,       this._options     )

Fixed version (after fix):
 class SaferEval {     if (typeof code !== 'string') {       throw new TypeError('not a string')     }     let src = 'Object.constructor = function () {};\n'     src += 'return ' + code + ';\n'      return vm.runInContext(       '(function () {"use strict"; ' + src + '})()',       this._context,       this._options     )

Patch:
patch: @@ -40,8 +40,11 @@ class SaferEval {
     if (typeof code !== 'string') {
       throw new TypeError('not a string')
     }
+    let src = 'Object.constructor = function () {};\n'
+    src += 'return ' + code + ';\n'
+
     return vm.runInContext(
-      '(function () {"use strict"; return ' + code + '})()',
+      '(function () {"use strict"; ' + src + '})()',
       this._context,
       this._options
     )
path: src/index.js