iris-sast/CWE-Bench-Java
CWE-Bench-Java This repository contains the dataset CWE-Bench-Java presented in the paper LLM-Assisted Static Analysis for Detecting Security Vulnerabilities. At a high level, this dataset contains 120 CVEs spanning 4 CWEs, namely path-traversal, OS-command injection, cross-site scripting, and code-injection. Each CVE includes the buggy and fixed source code of the project, along with the information of the fixed files and functions. We provide the seed information for each… See the full description on the dataset page: https://huggingface.co/datasets/iris-sast/CWE-Bench-Java.
1215
1{2 "schema_version": "1.4.0",3 "id": "GHSA-p9m8-27x8-rg87",4 "modified": "2021-11-15T22:23:17Z",5 "published": "2021-11-15T23:27:11Z",6 "aliases": [7 "CVE-2021-41269"8 ],9 "summary": "Critical vulnerability found in cron-utils",10 "details": "### Impact\nA Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.\n\n### Patches\nThe issue was patched and a new version was released. Please upgrade to version 9.1.6.\n\n### Workarounds\nThere are no known workarounds up to this moment.\n\n### References\nA description of the issue is provided in [issue 461](https://github.com/jmrozanec/cron-utils/issues/461)\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [cron-utils Github repository](https://github.com/jmrozanec/cron-utils)",11 "severity": [12 {13 "type": "CVSS_V3",14 "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"15 }16 ],17 "affected": [18 {19 "package": {20 "ecosystem": "Maven",21 "name": "com.cronutils:cron-utils"22 },23 "ranges": [24 {25 "type": "ECOSYSTEM",26 "events": [27 {28 "introduced": "0"29 },30 {31 "fixed": "9.1.6"32 }33 ]34 }35 ]36 }37 ],38 "references": [39 {40 "type": "WEB",41 "url": "https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-p9m8-27x8-rg87"42 },43 {44 "type": "ADVISORY",45 "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41269"46 },47 {48 "type": "WEB",49 "url": "https://github.com/jmrozanec/cron-utils/issues/461"50 },51 {52 "type": "WEB",53 "url": "https://github.com/jmrozanec/cron-utils/commit/cfd2880f80e62ea74b92fa83474c2aabdb9899da"54 },55 {56 "type": "WEB",57 "url": "https://github.com/jmrozanec/cron-utils/commit/d6707503ec2f20947f79e38f861dba93b39df9da"58 },59 {60 "type": "PACKAGE",61 "url": "https://github.com/jmrozanec/cron-utils"62 }63 ],64 "database_specific": {65 "cwe_ids": [66 "CWE-94"67 ],68 "severity": "CRITICAL",69 "github_reviewed": true,70 "github_reviewed_at": "2021-11-15T22:23:17Z",71 "nvd_published_at": "2021-11-15T21:15:00Z"72 }73}