rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Moderate severity vulnerability that affects mistune Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
Vulnerability ID: GHSA-98gj-wwxm-cj3h
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/lepture/mistune
Published: 2019-01-04
File: mistune.py
Commit message: Fix CVE-2017-16876
Commit author: Hsiaoming Yang

Vulnerable version (before fix):
 import re import inspect  __version__ = '0.8' __author__ = 'Hsiaoming Yang <me@lepture.com>' __all__ = [     'BlockGrammar', 'BlockLexer', def _pure_pattern(regex):   def _keyify(key):     return _key_pattern.sub(' ', key.lower())   def escape(text, quote=False, smart_amp=True): class InlineGrammar(object):     inline_html = re.compile(         r'^(?:%s|%s|%s)' % (             r'<!--[\s\S]*?-->',             r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (_valid_end, _valid_attr),             r'<\w+%s(?:%s)*?\s*\/?>' % (_valid_end, _valid_attr),         )     )

Fixed version (after fix):
 import re import inspect  __version__ = '0.8.1' __author__ = 'Hsiaoming Yang <me@lepture.com>' __all__ = [     'BlockGrammar', 'BlockLexer', def _pure_pattern(regex):   def _keyify(key):     key = escape(key.lower(), quote=True)     return _key_pattern.sub(' ', key)   def escape(text, quote=False, smart_amp=True): class InlineGrammar(object):     inline_html = re.compile(         r'^(?:%s|%s|%s)' % (             r'<!--[\s\S]*?-->',             r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (                 _valid_end, _valid_attr),             r'<\w+%s(?:%s)*?\s*\/?>' % (_valid_end, _valid_attr),         )     )

Patch:
patch: @@ -11,7 +11,7 @@
 import re
 import inspect
 
-__version__ = '0.8'
+__version__ = '0.8.1'
 __author__ = 'Hsiaoming Yang <me@lepture.com>'
 __all__ = [
     'BlockGrammar', 'BlockLexer',
@@ -48,7 +48,8 @@ def _pure_pattern(regex):
 
 
 def _keyify(key):
-    return _key_pattern.sub(' ', key.lower())
+    key = escape(key.lower(), quote=True)
+    return _key_pattern.sub(' ', key)
 
 
 def escape(text, quote=False, smart_amp=True):
@@ -445,7 +446,8 @@ class InlineGrammar(object):
     inline_html = re.compile(
         r'^(?:%s|%s|%s)' % (
             r'<!--[\s\S]*?-->',
-            r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (_valid_end, _valid_attr),
+            r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (
+                _valid_end, _valid_attr),
             r'<\w+%s(?:%s)*?\s*\/?>' % (_valid_end, _valid_attr),
         )
     )
path: mistune.py
Vulnerability: SQL Injection in showdoc Showdoc verions 2.10.2 and prior is vulnerable to SQL injection. A patch is available in the `master` branch of the repository.
Vulnerability ID: GHSA-9cq5-xgg4-x477
CWE: CWE-89
Severity score: 6.7
Project: https://github.com/star7th/showdoc
Published: 2022-01-27
File: server/Application/Api/Controller/AdminUserController.class.php
Commit message: bug
Commit author: star7th

Vulnerable version (before fix):
 public function addUser(){         $this->checkAdmin();         $username = I("post.username");         $password = I("post.password");         $uid = I("post.uid");         $name = I("post.name");         if(!$username){             $this->sendError(10101,'用户名不允许为空');

Fixed version (after fix):
 public function addUser(){         $this->checkAdmin();         $username = I("post.username");         $password = I("post.password");         $uid = I("post.uid/d");         $name = I("post.name");         if(!$username){             $this->sendError(10101,'用户名不允许为空');

Patch:
patch: @@ -76,7 +76,7 @@ public function addUser(){
         $this->checkAdmin();
         $username = I("post.username");
         $password = I("post.password");
-        $uid = I("post.uid");
+        $uid = I("post.uid/d");
         $name = I("post.name");
         if(!$username){
             $this->sendError(10101,'用户名不允许为空');
path: server/Application/Api/Controller/AdminUserController.class.php
Vulnerability: Cross-site Scripting in snipe-it snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: GHSA-9g3v-j3cr-6fc6
CWE: CWE-79
Severity score: 6.8
Project: https://github.com/snipe/snipe-it
Published: 2021-10-21
File: resources/views/partials/bootstrap-table.blade.php
Commit message: Fixes possible XSS on all-file-types export

Signed-off-by: snipe <snipe@snipe.net>
Commit author: snipe

Vulnerable version (before fix):
 classes: 'table table-responsive table-no-bordered',                 export: 'fa-download',                 clearSearch: 'fa-times'             },             exportTypes: ['csv', 'excel', 'doc', 'txt','json', 'xml', 'pdf'],             onLoadSuccess: function () {                 $('[data-toggle="tooltip"]').tooltip(); // Needed to attach tooltips after ajax call

Fixed version (after fix):
 classes: 'table table-responsive table-no-bordered',                 export: 'fa-download',                 clearSearch: 'fa-times'             },             exportOptions: {                 htmlContent: true,             },              exportTypes: ['csv', 'excel', 'doc', 'txt','json', 'xml', 'pdf'],             onLoadSuccess: function () {                 $('[data-toggle="tooltip"]').tooltip(); // Needed to attach tooltips after ajax call

Patch:
patch: @@ -75,6 +75,10 @@ classes: 'table table-responsive table-no-bordered',
                 export: 'fa-download',
                 clearSearch: 'fa-times'
             },
+            exportOptions: {
+                htmlContent: true,
+            },
+
             exportTypes: ['csv', 'excel', 'doc', 'txt','json', 'xml', 'pdf'],
             onLoadSuccess: function () {
                 $('[data-toggle="tooltip"]').tooltip(); // Needed to attach tooltips after ajax call
path: resources/views/partials/bootstrap-table.blade.php
Vulnerability: Cross-site Scripting in Microweber Microweber prior to 1.2.15 is vulnerable to reflected cross-site scripting on demo.microweber.org/demo/module/. This allows the execution of arbitrary JavaScript as the attacked user.
Vulnerability ID: GHSA-9w7h-3wwh-6m5q
CWE: CWE-79
Severity score: 6.3
Project: https://github.com/microweber/microweber
Published: 2022-04-23
File: src/MicroweberPackages/App/Http/Controllers/ApiController.php
Commit message: update
Commit author: Peter Ivanov

Vulnerable version (before fix):
 public function module()             $request_data_new = [];             $antixss = new AntiXSS();             foreach ($request_data as $k=>$v){                  $v = $antixss->xss_clean($v);                  if(is_string($k)){                     $k = $antixss->xss_clean($k);                     if($k){                         $request_data_new[$k] = $v;                     }                 } else {                     $request_data_new[$k] = $v;                 }                              }             $request_data = $request_data_new;         }

Fixed version (after fix):
 public function module()             $request_data_new = [];             $antixss = new AntiXSS();             foreach ($request_data as $k=>$v){                 if(is_string($v)) {                     $v = str_replace('<', '-', $v);                     $v = str_replace('>', '-', $v);                 }                 $v = $antixss->xss_clean($v);                  if(is_string($k)){                     $k = str_replace('<', '-', $k);                     $k = str_replace('>', '-', $k);                     $k = $antixss->xss_clean($k);                     if($k){                         $request_data_new[$k] = $v;                     }                 } else {                     $request_data_new[$k] = $v;                 }              }             $request_data = $request_data_new;         }

Patch:
patch: @@ -611,18 +611,23 @@ public function module()
             $request_data_new = [];
             $antixss = new AntiXSS();
             foreach ($request_data as $k=>$v){
-
+                if(is_string($v)) {
+                    $v = str_replace('<', '-', $v);
+                    $v = str_replace('>', '-', $v);
+                }
                 $v = $antixss->xss_clean($v);
 
                 if(is_string($k)){
+                    $k = str_replace('<', '-', $k);
+                    $k = str_replace('>', '-', $k);
                     $k = $antixss->xss_clean($k);
                     if($k){
                         $request_data_new[$k] = $v;
                     }
                 } else {
                     $request_data_new[$k] = $v;
                 }
-                
+
             }
             $request_data = $request_data_new;
         }
path: src/MicroweberPackages/App/Http/Controllers/ApiController.php
Vulnerability: Unrestricted File Upload in ShowDoc v2.9.5 Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.
Vulnerability ID: GHSA-c442-3278-rhrg
CWE: CWE-434
Severity score: 9.8
Project: https://github.com/star7th/showdoc
Published: 2021-09-09
File: server/Application/Api/Controller/AdminUpdateController.class.php
Commit message: Fix security vulnerabilities
Commit author: star7th

Vulnerable version (before fix):
 public function checkUpdate(){      // 下载更新代码包     public function download(){         set_time_limit(1000);         ini_set('memory_limit','500M');         $new_version = I("new_version") ; public function download(){      // 执行升级操作，升级覆盖文件     public function updateFiles(){         set_time_limit(1000);         ini_set('memory_limit','500M');         

Fixed version (after fix):
 public function checkUpdate(){      // 下载更新代码包     public function download(){         $this->checkLogin();         $this->checkAdmin();         set_time_limit(1000);         ini_set('memory_limit','500M');         $new_version = I("new_version") ; public function download(){      // 执行升级操作，升级覆盖文件     public function updateFiles(){         $this->checkLogin();         $this->checkAdmin();         set_time_limit(1000);         ini_set('memory_limit','500M');         

Patch:
patch: @@ -24,6 +24,8 @@ public function checkUpdate(){
 
     // 下载更新代码包
     public function download(){
+        $this->checkLogin();
+        $this->checkAdmin();
         set_time_limit(1000);
         ini_set('memory_limit','500M');
         $new_version = I("new_version") ;
@@ -78,6 +80,8 @@ public function download(){
 
     // 执行升级操作，升级覆盖文件
     public function updateFiles(){
+        $this->checkLogin();
+        $this->checkAdmin();
         set_time_limit(1000);
         ini_set('memory_limit','500M');
path: server/Application/Api/Controller/AdminUpdateController.class.php
Vulnerability: Cross-Site Scripting in @berslucas/liljs Versions of  `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.


## Recommendation

Upgrade to version 1.0.2 or later.
Vulnerability ID: GHSA-c53x-wwx2-pg96
CWE: CWE-79
Severity score: 6.5
Project: https://github.com/bersLucas/liljs
Published: 2020-09-03
File: src/liljs.js
Commit message: Use textContent over innerHTML so you can bind untrusted text values
without the possibility of an XSS attack.
Commit author: Cody Mikol

Vulnerable version (before fix):
 const liljs = (elem, data = {}) => {      * @param {String} property Name of the property to render      * @param {String} value (Optional) A value to use instead of a property (used in lil-list-text)      */     const setText = (elem, property, value) => elem.innerHTML = value || state[property].value;      /** Set style helper function      * @function setStyle const liljs = (elem, data = {}) => {      */     const setList = (elem, property) => {       //TODO: Find a way to update without clearing lists       elem.innerHTML = "";       state[property].value.forEach(value => {         let clone = document.importNode(state[property].template.content, true);         clone.querySelectorAll("[lil-list-text]").forEach(node => {

Fixed version (after fix):
 const liljs = (elem, data = {}) => {      * @param {String} property Name of the property to render      * @param {String} value (Optional) A value to use instead of a property (used in lil-list-text)      */     const setText = (elem, property, value) => elem.textContent = value || state[property].value;      /** Set style helper function      * @function setStyle const liljs = (elem, data = {}) => {      */     const setList = (elem, property) => {       //TODO: Find a way to update without clearing lists       elem.textContent = "";       state[property].value.forEach(value => {         let clone = document.importNode(state[property].template.content, true);         clone.querySelectorAll("[lil-list-text]").forEach(node => {

Patch:
patch: @@ -21,7 +21,7 @@ const liljs = (elem, data = {}) => {
      * @param {String} property Name of the property to render
      * @param {String} value (Optional) A value to use instead of a property (used in lil-list-text)
      */
-    const setText = (elem, property, value) => elem.innerHTML = value || state[property].value;
+    const setText = (elem, property, value) => elem.textContent = value || state[property].value;
 
     /** Set style helper function
      * @function setStyle
@@ -43,7 +43,7 @@ const liljs = (elem, data = {}) => {
      */
     const setList = (elem, property) => {
       //TODO: Find a way to update without clearing lists
-      elem.innerHTML = "";
+      elem.textContent = "";
       state[property].value.forEach(value => {
         let clone = document.importNode(state[property].template.content, true);
         clone.querySelectorAll("[lil-list-text]").forEach(node => {
path: src/liljs.js
Vulnerability: OS command injection in BibTeX-Ruby BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.
Vulnerability ID: GHSA-c5r5-7pfh-6qg6
CWE: CWE-78
Severity score: 9.8
Project: https://github.com/inukshuk/bibtex-ruby
Published: 2020-02-14
File: lib/bibtex/bibliography.rb
Commit message: Use File.read instead of Kernel.open

To avoid command injection with | strings
Commit author: Sylvester Keil

Vulnerable version (before fix):
 class << self       # -:filter: convert all entries using the sepcified filter (not set by default)       #       def open(path, options = {})         b = parse(Kernel.open(path, 'r:UTF-8').read, options)         b.path = path         return b unless block_given? 

Fixed version (after fix):
 class << self       # -:filter: convert all entries using the sepcified filter (not set by default)       #       def open(path, options = {})         b = parse(File.read(path), options)         b.path = path         return b unless block_given? 

Patch:
patch: @@ -47,7 +47,7 @@ class << self
       # -:filter: convert all entries using the sepcified filter (not set by default)
       #
       def open(path, options = {})
-        b = parse(Kernel.open(path, 'r:UTF-8').read, options)
+        b = parse(File.read(path), options)
         b.path = path
         return b unless block_given?
path: lib/bibtex/bibliography.rb
Vulnerability: Unrestricted Upload of File with Dangerous Type in pimcore Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore
Vulnerability ID: GHSA-c697-r227-pq6h
CWE: CWE-434
Severity score: 7.8
Project: https://github.com/pimcore/pimcore
Published: 2022-01-21
File: bundles/AdminBundle/Controller/Admin/SettingsController.php
Commit message: [Settings] Validate SVG uploads for branding
Commit author: Bernhard Rusch

Vulnerable version (before fix):
 public function uploadCustomLogoAction(Request $request)             throw new \Exception('Unsupported file format');         }          $storage = Tool\Storage::get('admin');         $storage->writeStream(self::CUSTOM_LOGO_PATH, fopen($_FILES['Filedata']['tmp_name'], 'rb')); 

Fixed version (after fix):
 public function uploadCustomLogoAction(Request $request)             throw new \Exception('Unsupported file format');         }          if($fileExt === 'svg') {             if(strpos(file_get_contents($_FILES['Filedata']['tmp_name']), '<script')) {                 throw new \Exception('Scripts in SVG files are not supported');             }         }          $storage = Tool\Storage::get('admin');         $storage->writeStream(self::CUSTOM_LOGO_PATH, fopen($_FILES['Filedata']['tmp_name'], 'rb')); 

Patch:
patch: @@ -109,6 +109,12 @@ public function uploadCustomLogoAction(Request $request)
             throw new \Exception('Unsupported file format');
         }
 
+        if($fileExt === 'svg') {
+            if(strpos(file_get_contents($_FILES['Filedata']['tmp_name']), '<script')) {
+                throw new \Exception('Scripts in SVG files are not supported');
+            }
+        }
+
         $storage = Tool\Storage::get('admin');
         $storage->writeStream(self::CUSTOM_LOGO_PATH, fopen($_FILES['Filedata']['tmp_name'], 'rb'));
path: bundles/AdminBundle/Controller/Admin/SettingsController.php
Vulnerability: Improper authentication in Symfony In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Vulnerability ID: GHSA-cchx-mfrc-fwqr
CWE: CWE-287
Severity score: 7.5
Project: https://github.com/symfony/symfony
Published: 2020-02-12
File: src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php
Commit message: [Security] Add a separator in the remember me cookie hash
Commit author: Pascal Borreli

Vulnerable version (before fix):
 protected function generateCookieValue($class, $username, $expires, $password)      */     protected function generateCookieHash($class, $username, $expires, $password)     {         return hash_hmac('sha256', $class.$username.$expires.$password, $this->getSecret());     } }

Fixed version (after fix):
 protected function generateCookieValue($class, $username, $expires, $password)      */     protected function generateCookieHash($class, $username, $expires, $password)     {         return hash_hmac('sha256', $class.self::COOKIE_DELIMITER.$username.self::COOKIE_DELIMITER.$expires.self::COOKIE_DELIMITER.$password, $this->getSecret());     } }

Patch:
patch: @@ -120,6 +120,6 @@ protected function generateCookieValue($class, $username, $expires, $password)
      */
     protected function generateCookieHash($class, $username, $expires, $password)
     {
-        return hash_hmac('sha256', $class.$username.$expires.$password, $this->getSecret());
+        return hash_hmac('sha256', $class.self::COOKIE_DELIMITER.$username.self::COOKIE_DELIMITER.$expires.self::COOKIE_DELIMITER.$password, $this->getSecret());
     }
 }
path: src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php
Vulnerability: Improper authentication in Symfony In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Vulnerability ID: GHSA-cchx-mfrc-fwqr
CWE: CWE-200
Severity score: 7.5
Project: https://github.com/symfony/symfony
Published: 2020-02-12
File: src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php
Commit message: [Security] Add a separator in the remember me cookie hash
Commit author: Pascal Borreli

Vulnerable version (before fix):
 protected function generateCookieValue($class, $username, $expires, $password)      */     protected function generateCookieHash($class, $username, $expires, $password)     {         return hash_hmac('sha256', $class.$username.$expires.$password, $this->getSecret());     } }

Fixed version (after fix):
 protected function generateCookieValue($class, $username, $expires, $password)      */     protected function generateCookieHash($class, $username, $expires, $password)     {         return hash_hmac('sha256', $class.self::COOKIE_DELIMITER.$username.self::COOKIE_DELIMITER.$expires.self::COOKIE_DELIMITER.$password, $this->getSecret());     } }

Patch:
patch: @@ -120,6 +120,6 @@ protected function generateCookieValue($class, $username, $expires, $password)
      */
     protected function generateCookieHash($class, $username, $expires, $password)
     {
-        return hash_hmac('sha256', $class.$username.$expires.$password, $this->getSecret());
+        return hash_hmac('sha256', $class.self::COOKIE_DELIMITER.$username.self::COOKIE_DELIMITER.$expires.self::COOKIE_DELIMITER.$password, $this->getSecret());
     }
 }
path: src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeServices.php
Vulnerability: Division by zero in TFLite ### Impact
The implementation of fully connected layers in TFLite is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/fully_connected.cc#L226):

```cc
const int batch_size = input_size / filter->dims->data[1];
```

An attacker can craft a model such that `filter->dims->data[1]` is 0.

### Patches
We have patched the issue in GitHub commit [718721986aa137691ee23f03638867151f74935f](https://github.com/tensorflow/tensorflow/commit/718721986aa137691ee23f03638867151f74935f).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360. Concurrently, it has also been reported by Yakun Zhang of Baidu Security.
Vulnerability ID: GHSA-cfpj-3q4c-jhvr
CWE: CWE-369
Severity score: 5.5
Project: https://github.com/tensorflow/tensorflow
Published: 2021-08-25
File: tensorflow/lite/kernels/fully_connected.cc
Commit message: Prevent division by 0 in `fully_connected.cc`

PiperOrigin-RevId: 385137282
Change-Id: If201e69b6e0048f0be001330b4b977e2b46db2cb
Commit author: Mihai Maruseac

Vulnerable version (before fix):
 TfLiteStatus PrepareImpl(TfLiteContext* context, TfLiteNode* node) {   }    TF_LITE_ENSURE_EQ(context, NumDimensions(filter), 2);   const int batch_size = input_size / filter->dims->data[1];   const int num_units = filter->dims->data[0]; 

Fixed version (after fix):
 TfLiteStatus PrepareImpl(TfLiteContext* context, TfLiteNode* node) {   }    TF_LITE_ENSURE_EQ(context, NumDimensions(filter), 2);   TF_LITE_ENSURE(context, filter->dims->data[1] != 0);   const int batch_size = input_size / filter->dims->data[1];   const int num_units = filter->dims->data[0]; 

Patch:
patch: @@ -223,6 +223,7 @@ TfLiteStatus PrepareImpl(TfLiteContext* context, TfLiteNode* node) {
   }
 
   TF_LITE_ENSURE_EQ(context, NumDimensions(filter), 2);
+  TF_LITE_ENSURE(context, filter->dims->data[1] != 0);
   const int batch_size = input_size / filter->dims->data[1];
   const int num_units = filter->dims->data[0];
path: tensorflow/lite/kernels/fully_connected.cc