Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2013-5029: Improper Input Validation (CWE-20)
value: phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-08-19T23:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/Header.class.php
Commit date: 2013-07-30 09:40:56 +0200
Commit message: Display none only if protection is enabled

Diff: diff --git a/libraries/Header.class.php b/libraries/Header.class.php
index 8e4ba3393ddf..f8b6a1038c5c 100644
--- a/libraries/Header.class.php
+++ b/libraries/Header.class.php
@@ -529,11 +529,13 @@ private function _getHtmlStart()
     private function _getMetaTags()
     {
         $retval  = '<meta charset="utf-8" />';
         $retval .= '<meta name="robots" content="noindex,nofollow" />';
         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
-        $retval .= '<style>html{display: none;}</style>';
+        if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
+            $retval .= '<style>html{display: none;}</style>';
+        }
         return $retval;
     }
 
     /**
      * Returns the LINK tags for the favicon and the stylesheets

Vulnerable code:         $retval .= '<style>html{display: none;}</style>';
Fixed code:         if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
            $retval .= '<style>html{display: none;}</style>';
        }
CVE-2014-1879: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-02-20T15:27Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: import.php
Commit date: 2014-02-05 09:25:31 +0100
Commit message: Sanitize filename in import message

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/import.php b/import.php
index 61ad4acfcafa..85a78142add5 100644
--- a/import.php
+++ b/import.php
@@ -566,13 +566,13 @@
 
         if ($import_notice) {
             $message->addString($import_notice);
         }
         if (isset($local_import_file)) {
-            $message->addString('(' . $local_import_file . ')');
+            $message->addString('(' . htmlspecialchars($local_import_file) . ')');
         } else {
-            $message->addString('(' . $_FILES['import_file']['name'] . ')');
+            $message->addString('(' . htmlspecialchars($_FILES['import_file']['name']) . ')');
         }
     }
 }
 
 // Did we hit timeout? Tell it user.

Vulnerable code:             $message->addString('(' . $local_import_file . ')');
            $message->addString('(' . $_FILES['import_file']['name'] . ')');
Fixed code:             $message->addString('(' . htmlspecialchars($local_import_file) . ')');
            $message->addString('(' . htmlspecialchars($_FILES['import_file']['name']) . ')');
CVE-2014-4954: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-07-20T11:12Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/structure.lib.php
Commit date: 2014-07-11 06:36:17 -0400
Commit message: bug #4486 [security] XSS injection due to unescaped table comment

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index 6027e04dec62..431379ee70f2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -9,10 +9,11 @@ phpMyAdmin - ChangeLog
 - bug       Undefined variable when grid editing a foreign key column
 - bug #4481 mult_submits.inc.php Undefined variable Error
 - bug #4485 Sorting breaks the copy column feature
 - bug #4440 Javascript error when renaming table
 - bug #4483 'New window' link (selflink) disappears, causing Javascript error
+- bug #4486 [security] XSS injection due to unescaped table comment
 
 4.2.5.0 (2014-06-26)
 - bug #4467 shell_exec() has been disabled for security reasons
 - bug #4470 Error while submitting empty query
 - bug #4463 Fatal error: Class 'PMA_DatabaseInterface' not found
diff --git a/libraries/structure.lib.php b/libraries/structure.lib.php
index 27ddcc384cae..f8bf4bf5f9d1 100644
--- a/libraries/structure.lib.php
+++ b/libraries/structure.lib.php
@@ -51,11 +51,12 @@ function PMA_getHtmlForActionLinks($current_table, $table_is_view, $tbl_url_quer
         $search_table .= $titles['NoSearch'];
     }
     $search_table .= '</a>';
 
     $browse_table_label = '<a href="sql.php?' . $tbl_url_query
-        . '&amp;pos=0" title="' . $current_table['TABLE_COMMENT'] . '">'
+        . '&amp;pos=0" title="'
+        . htmlspecialchars($current_table['TABLE_COMMENT']) . '">'
         . $truename . '</a>';
 
     if (!$db_is_system_schema) {
         $empty_table = '<a class="truncate_table_anchor ajax"';
         $empty_table .= ' href="sql.php?' . $tbl_url_query

Vulnerable code:         . '&amp;pos=0" title="' . $current_table['TABLE_COMMENT'] . '">'
Fixed code: - bug #4486 [security] XSS injection due to unescaped table comment
        . '&amp;pos=0" title="'
        . htmlspecialchars($current_table['TABLE_COMMENT']) . '">'
CVE-2014-4987: Permissions, Privileges, and Access Controls (CWE-264)
value: server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2014-07-20T11:12Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, server_user_groups.php
Commit date: 2014-07-17 17:30:44 -0400
Commit message: bug #4491 [security] Missing validation for accessing User groups feature

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index 66c51992da8f..d6089b418542 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -14,10 +14,11 @@ phpMyAdmin - ChangeLog
 - bug #4489 Incorrect detection of privileges for routine creation
 - bug #4459 First few characters of database name aren't clickable when expanded
 - bug #4486 [security] XSS injection due to unescaped table comment
 - bug #4488 [security] XSS injection due to unescaped table name (triggers)
 - bug #4492 [security] XSS in AJAX confirmation messages
+- bug #4491 [security] Missing validation for accessing User groups feature
 
 4.2.5.0 (2014-06-26)
 - bug #4467 shell_exec() has been disabled for security reasons
 - bug #4470 Error while submitting empty query
 - bug #4463 Fatal error: Class 'PMA_DatabaseInterface' not found
diff --git a/server_user_groups.php b/server_user_groups.php
index 7236a9161551..0d7358e7d86b 100644
--- a/server_user_groups.php
+++ b/server_user_groups.php
@@ -18,10 +18,18 @@
 $response = PMA_Response::getInstance();
 $header   = $response->getHeader();
 $scripts  = $header->getScripts();
 $scripts->addFile('server_user_groups.js');
 
+/**
+ * Only allowed to superuser 
+ */
+if (! $GLOBALS['is_superuser']) {
+    $response->addHTML(PMA_Message::error(__('No Privileges'))->getDisplay());
+    exit;
+}
+
 $response->addHTML('<div>');
 $response->addHTML(PMA_getHtmlForSubMenusOnUsersPage('server_user_groups.php'));
 
 /**
  * Delete user group
@@ -59,6 +67,6 @@
     // Display user groups table
     $response->addHTML(PMA_getHtmlForUserGroupsTable());
 }
 
 $response->addHTML('</div>');
-?>
\ No newline at end of file
+?>

Vulnerable code: ?>
Fixed code: - bug #4491 [security] Missing validation for accessing User groups feature
/**
 * Only allowed to superuser 
 */
if (! $GLOBALS['is_superuser']) {
    $response->addHTML(PMA_Message::error(__('No Privileges'))->getDisplay());
    exit;
}

?>
CVE-2014-5273: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-08-22T01:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, js/sql.js
Commit date: 2014-08-17 08:45:10 -0400
Commit message: bug #4501 [security] XSS in table browse page

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index cec9d77fad88..54120c205306 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,9 +1,10 @@
 phpMyAdmin - ChangeLog
 ======================
 
 4.2.7.1 (2014-08-17)
+- bug #4501 [security] XSS in table browse page
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
 - bug #4494 Overlap in navigation panel
diff --git a/js/sql.js b/js/sql.js
index 8b77c1aae0b0..aad4a454e8b6 100644
--- a/js/sql.js
+++ b/js/sql.js
@@ -117,11 +117,11 @@ AJAX.registerTeardown('sql.js', function () {
  */
 AJAX.registerOnload('sql.js', function () {
     // Delete row from SQL results
     $('a.delete_row.ajax').live('click', function (e) {
         e.preventDefault();
-        var question = $.sprintf(PMA_messages.strDoYouReally, $(this).closest('td').find('div').text());
+        var question = $.sprintf(PMA_messages.strDoYouReally, escapeHtml($(this).closest('td').find('div').text()));
         var $link = $(this);
         $link.PMA_confirm(question, $link.attr('href'), function (url) {
             $msgbox = PMA_ajaxShowMessage();
             $.get(url, {'ajax_request': true, 'is_js_confirmed': true}, function (data) {
                 if (data.success) {

Vulnerable code:         var question = $.sprintf(PMA_messages.strDoYouReally, $(this).closest('td').find('div').text());
Fixed code: - bug #4501 [security] XSS in table browse page
        var question = $.sprintf(PMA_messages.strDoYouReally, escapeHtml($(this).closest('td').find('div').text()));
CVE-2014-5273: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-08-22T01:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, js/tbl_chart.js
Commit date: 2014-08-17 08:52:05 -0400
Commit message: bug #4504 [security] Self-XSS in query charts

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index 94b41b5d264e..eea09d6158aa 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,10 +3,11 @@ phpMyAdmin - ChangeLog
 
 4.2.7.1 (2014-08-17)
 - bug #4501 [security] XSS in table browse page
 - bug #4502 [security] Self-XSS in enum value editor
 - bug #4503 [security] Self-XSSes in monitor
+- bug #4504 [security] Self-XSS in query charts
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
 - bug #4494 Overlap in navigation panel
diff --git a/js/tbl_chart.js b/js/tbl_chart.js
index 943d4aee3550..04c9c40b0c2d 100644
--- a/js/tbl_chart.js
+++ b/js/tbl_chart.js
@@ -45,11 +45,11 @@ function PMA_queryChart(data, columnNames, settings) {
             placement : 'outsideGrid',
             location : 'e'
         },
         axes : {
             xaxis : {
-                label : settings.xaxisLabel
+                label : escapeHtml(settings.xaxisLabel)
             },
             yaxis : {
                 label : settings.yaxisLabel
             }
         },

Vulnerable code:                 label : settings.xaxisLabel
Fixed code: - bug #4504 [security] Self-XSS in query charts
                label : escapeHtml(settings.xaxisLabel)
CVE-2014-5273: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-08-22T01:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/tbl_relation.lib.php
Commit date: 2014-08-17 08:54:05 -0400
Commit message: bug #4517 [security] XSS in relation view

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index eea09d6158aa..1edd1858bcea 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,10 +5,11 @@ phpMyAdmin - ChangeLog
 - bug #4501 [security] XSS in table browse page
 - bug #4502 [security] Self-XSS in enum value editor
 - bug #4503 [security] Self-XSSes in monitor
 - bug #4504 [security] Self-XSS in query charts
 - bug #4505 [security] XSS in view operations page
+- bug #4517 [security] XSS in relation view
 
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
 - bug #4494 Overlap in navigation panel
 - bug #4427 Action icons not in horizontal order
diff --git a/libraries/tbl_relation.lib.php b/libraries/tbl_relation.lib.php
index 0e1bc3d8020d..60b020ed47b9 100644
--- a/libraries/tbl_relation.lib.php
+++ b/libraries/tbl_relation.lib.php
@@ -552,11 +552,11 @@ function PMA_getHtmlForForeignKey($save_row, $i, $existrel_foreign, $myfield, $d
         $constraint_name = isset($existrel_foreign[$myfield]['constraint'])
             ? $existrel_foreign[$myfield]['constraint'] : '';
         $html_output .= __('Constraint name');
         $html_output .= '<input type="text" name="constraint_name['
             . $myfield_md5 . ']"'
-            . ' value="' . $constraint_name . '"/>';
+            . ' value="' . htmlspecialchars($constraint_name) . '"/>';
         $html_output .= '</span>' . "\n";
 
         $html_output .= '<span class="formelement clearfloat">';
         // For ON DELETE and ON UPDATE, the default action
         // is RESTRICT as per MySQL doc; however, a SHOW CREATE TABLE

Vulnerable code:             . ' value="' . $constraint_name . '"/>';
Fixed code: - bug #4517 [security] XSS in relation view
            . ' value="' . htmlspecialchars($constraint_name) . '"/>';
CVE-2014-5273: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-08-22T01:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, js/server_status_monitor.js
Commit date: 2014-08-17 08:50:27 -0400
Commit message: bug #4503 [security] Self-XSSes in monitor

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index 941a059ada21..94b41b5d264e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,10 +2,11 @@ phpMyAdmin - ChangeLog
 ======================
 
 4.2.7.1 (2014-08-17)
 - bug #4501 [security] XSS in table browse page
 - bug #4502 [security] Self-XSS in enum value editor
+- bug #4503 [security] Self-XSSes in monitor
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
 - bug #4494 Overlap in navigation panel
diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js
index c3a0c5389372..f5465ed6f70f 100644
--- a/js/server_status_monitor.js
+++ b/js/server_status_monitor.js
@@ -906,11 +906,11 @@ AJAX.registerOnload('server_status_monitor.js', function () {
 
         var newSeries = {
             label: $('#variableInput').val().replace(/_/g, " ")
         };
         newChart.series.push(newSeries);
-        $('#seriesPreview').append('- ' + newSeries.label + str + '<br/>');
+        $('#seriesPreview').append('- ' + escapeHtml(newSeries.label + str) + '<br/>');
         newChart.nodes.push(serie);
         $('#variableInput').val('');
         $('input[name="differentialValue"]').prop('checked', true);
         $('input[name="useDivisor"]').prop('checked', false);
         $('input[name="useUnit"]').prop('checked', false);

Vulnerable code:         $('#seriesPreview').append('- ' + newSeries.label + str + '<br/>');
Fixed code: - bug #4503 [security] Self-XSSes in monitor
        $('#seriesPreview').append('- ' + escapeHtml(newSeries.label + str) + '<br/>');
CVE-2014-5273: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-08-22T01:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, js/functions.js
Commit date: 2014-08-17 08:47:53 -0400
Commit message: bug #4502 [security] Self-XSS in enum value editor

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index 54120c205306..941a059ada21 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
 4.2.7.1 (2014-08-17)
 - bug #4501 [security] XSS in table browse page
+- bug #4502 [security] Self-XSS in enum value editor
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
 - bug #4494 Overlap in navigation panel
diff --git a/js/functions.js b/js/functions.js
index a970a81584bb..bcdead8e1719 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -2690,11 +2690,11 @@ AJAX.registerOnload('functions.js', function () {
         if (colname.length < 1) {
             title = PMA_messages.enum_newColumnVals;
         } else {
             title = PMA_messages.enum_columnVals.replace(
                 /%s/,
-                '"' + decodeURIComponent(colname) + '"'
+                '"' + escapeHtml(decodeURIComponent(colname)) + '"'
             );
         }
         // Get the values as a string
         var inputstring = $(this)
             .closest('td')

Vulnerable code:                 '"' + decodeURIComponent(colname) + '"'
Fixed code: - bug #4502 [security] Self-XSS in enum value editor
                '"' + escapeHtml(decodeURIComponent(colname)) + '"'
CVE-2014-5274: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-08-22T01:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, js/functions.js
Commit date: 2014-08-17 08:41:57 -0400
Commit message: bug #4505 [security] XSS in view operations page

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/ChangeLog b/ChangeLog
index 7afac1ac443b..cec9d77fad88 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
+4.2.7.1 (2014-08-17)
+- bug #4505 [security] XSS in view operations page
+
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
 - bug #4494 Overlap in navigation panel
 - bug #4427 Action icons not in horizontal order
 - bug #4493 s_attention.png is missing
diff --git a/js/functions.js b/js/functions.js
index 09bfeda57f66..a970a81584bb 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -3583,11 +3583,11 @@ AJAX.registerOnload('functions.js', function () {
          * @var question    String containing the question to be asked for confirmation
          */
         var question = PMA_messages.strDropTableStrongWarning + ' ';
         question += $.sprintf(
             PMA_messages.strDoYouReally,
-            'DROP VIEW ' + PMA_commonParams.get('table')
+            'DROP VIEW ' + escapeHtml(PMA_commonParams.get('table'))
         );
 
         $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
 
             var $msgbox = PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);

Vulnerable code:             'DROP VIEW ' + PMA_commonParams.get('table')
Fixed code: 4.2.7.1 (2014-08-17)
- bug #4505 [security] XSS in view operations page

            'DROP VIEW ' + escapeHtml(PMA_commonParams.get('table'))
CVE-2014-7217: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-10-03T01:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/TableSearch.class.php
Commit date: 2014-10-01 08:09:12 -0400
Commit message: Bug 4544: additional fix for 4.2.x

Signed-off-by: Marc Delisle <marc@infomarc.info>

Diff: diff --git a/libraries/TableSearch.class.php b/libraries/TableSearch.class.php
index a0b3fa4924a7..b7eb42f17615 100644
--- a/libraries/TableSearch.class.php
+++ b/libraries/TableSearch.class.php
@@ -990,11 +990,12 @@ private function _getRowsNormal()
                 . htmlspecialchars($properties['type'])
                 . '</td>';
             $html_output .= '<td>' . $properties['collation'] . '</td>';
             $html_output .= '<td>' . $properties['func'] . '</td>';
             // here, the data-type attribute is needed for a date/time picker
-            $html_output .= '<td data-type="' . $properties['type'] . '"'
+            $html_output .= '<td data-type="'
+                . htmlspecialchars($properties['type']) . '"'
                 . '>' . $properties['value'] . '</td>';
             $html_output .= '</tr>';
             //Displays hidden fields
             $html_output .= '<tr><td>';
             $html_output .= '<input type="hidden"'

Vulnerable code:             $html_output .= '<td data-type="' . $properties['type'] . '"'
Fixed code:             $html_output .= '<td data-type="'
                . htmlspecialchars($properties['type']) . '"'
CVE-2014-8326: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-05T11:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/DatabaseInterface.class.php
Commit date: 2014-10-21 08:42:02 +0530
Commit message: bug #4562 [security] XSS in debug SQL output

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index 975b173306c1..02d02217d058 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
+4.2.10.1 (not yet released)
+- bug #4562 [security] XSS in debug SQL output
+
 4.2.10.0 (2014-10-11)
 - bug #4361 Can't change font size (when config.inc.php not present)
 - bug #4542 Tab key in column name not shown
 - bug       PDF export: title not present in PDF
 - bug #4543 Changing column name can break saved "order by" clause
diff --git a/libraries/DatabaseInterface.class.php b/libraries/DatabaseInterface.class.php
index c126c17d5d22..c7c51714205c 100644
--- a/libraries/DatabaseInterface.class.php
+++ b/libraries/DatabaseInterface.class.php
@@ -137,14 +137,15 @@ private function _dbgQuery($query, $link, $result, $time)
             $_SESSION['debug']['queries'][$hash]['count']++;
         } else {
             $_SESSION['debug']['queries'][$hash] = array();
             if ($result == false) {
                 $_SESSION['debug']['queries'][$hash]['error']
-                    = '<b style="color:red">' . mysqli_error($link) . '</b>';
+                    = '<b style="color:red">'
+                        . htmlspecialchars(mysqli_error($link)) . '</b>';
             }
             $_SESSION['debug']['queries'][$hash]['count'] = 1;
-            $_SESSION['debug']['queries'][$hash]['query'] = $query;
+            $_SESSION['debug']['queries'][$hash]['query'] = htmlspecialchars($query);
             $_SESSION['debug']['queries'][$hash]['time'] = $time;
         }
 
         $trace = array();
         foreach (debug_backtrace() as $trace_step) {

Vulnerable code:                     = '<b style="color:red">' . mysqli_error($link) . '</b>';
            $_SESSION['debug']['queries'][$hash]['query'] = $query;
Fixed code: 4.2.10.1 (not yet released)
- bug #4562 [security] XSS in debug SQL output

                    = '<b style="color:red">'
                        . htmlspecialchars(mysqli_error($link)) . '</b>';
            $_SESSION['debug']['queries'][$hash]['query'] = htmlspecialchars($query);
CVE-2014-8958: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-30T11:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, tbl_zoom_select.php
Commit date: 2014-11-20 06:28:43 +0530
Commit message: bug #4579 [security] XSS vulnerability in zoom search page

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index a5e3033e391b..001e9fa27168 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -14,10 +14,11 @@ phpMyAdmin - ChangeLog
 - bug #4602 Exporting selected rows exports all rows of the query
 - bug #4444 No insert statement produced in SQL export for queries with alias
 - bug #4596 [security] XSS through exception stack
 - bug #4595 [security] Path traversal can lead to leakage of line count
 - bug #4578 [security] XSS vulnerability in table print view
+- bug #4579 [security] XSS vulnerability in zoom search page
 
 4.2.11.0 (2014-10-31)
 - bug       ReferenceError: Table_onover is not defined
 - bug #4552 Incorrect routines display for database due to case insensitive checks
 - bug #4259 reCaptcha sound session expired problem
diff --git a/tbl_zoom_select.php b/tbl_zoom_select.php
index 7f4ceea329cc..7bbaab7b7e17 100644
--- a/tbl_zoom_select.php
+++ b/tbl_zoom_select.php
@@ -79,11 +79,11 @@
         $response->addJSON('field_value', '');
         exit;
     }
     $key = array_search($field, $table_search->getColumnNames());
     $properties = $table_search->getColumnProperties($_REQUEST['it'], $key);
-    $response->addJSON('field_type', $properties['type']);
+    $response->addJSON('field_type', htmlspecialchars($properties['type']));
     $response->addJSON('field_collation', $properties['collation']);
     $response->addJSON('field_operators', $properties['func']);
     $response->addJSON('field_value', $properties['value']);
     exit;
 }

Vulnerable code:     $response->addJSON('field_type', $properties['type']);
Fixed code: - bug #4579 [security] XSS vulnerability in zoom search page
    $response->addJSON('field_type', htmlspecialchars($properties['type']));
CVE-2014-8958: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-30T11:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/tbl_printview.lib.php
Commit date: 2014-11-20 06:26:55 +0530
Commit message: bug #4578 [security] XSS vulnerability in table print view

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index 29831777c062..a5e3033e391b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,10 +13,11 @@ phpMyAdmin - ChangeLog
 - bug #4599 Input field unnecessarily selected on focus
 - bug #4602 Exporting selected rows exports all rows of the query
 - bug #4444 No insert statement produced in SQL export for queries with alias
 - bug #4596 [security] XSS through exception stack
 - bug #4595 [security] Path traversal can lead to leakage of line count
+- bug #4578 [security] XSS vulnerability in table print view
 
 4.2.11.0 (2014-10-31)
 - bug       ReferenceError: Table_onover is not defined
 - bug #4552 Incorrect routines display for database due to case insensitive checks
 - bug #4259 reCaptcha sound session expired problem
diff --git a/libraries/tbl_printview.lib.php b/libraries/tbl_printview.lib.php
index a4a81ebbb1eb..0176f4048809 100644
--- a/libraries/tbl_printview.lib.php
+++ b/libraries/tbl_printview.lib.php
@@ -105,11 +105,11 @@ function PMA_getHtmlForPrintViewColumns(
             $html .= '    <u>' . $field_name . '</u>' . "\n";
         } else {
             $html .= '    ' . $field_name . "\n";
         }
         $html .= '</td>';
-        $html .= '<td>' . $type . '<bdo dir="ltr"></bdo></td>';
+        $html .= '<td>' . htmlspecialchars($type) . '<bdo dir="ltr"></bdo></td>';
         $html .= '<td>';
         $html .= (($row['Null'] == '' || $row['Null'] == 'NO')
             ? __('No')
             : __('Yes'));
         $html .= '&nbsp;</td>';

Vulnerable code:         $html .= '<td>' . $type . '<bdo dir="ltr"></bdo></td>';
Fixed code: - bug #4578 [security] XSS vulnerability in table print view
        $html .= '<td>' . htmlspecialchars($type) . '<bdo dir="ltr"></bdo></td>';
CVE-2014-8959: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2014-11-30T11:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/gis/GIS_Factory.class.php
Commit date: 2014-11-20 06:32:57 +0530
Commit message: bug #4594 [security] Path traversal in file inclusion of GIS factory

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index 001e9fa27168..7877bcb3f647 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,10 +15,11 @@ phpMyAdmin - ChangeLog
 - bug #4444 No insert statement produced in SQL export for queries with alias
 - bug #4596 [security] XSS through exception stack
 - bug #4595 [security] Path traversal can lead to leakage of line count
 - bug #4578 [security] XSS vulnerability in table print view
 - bug #4579 [security] XSS vulnerability in zoom search page
+- bug #4594 [security] Path traversal in file inclusion of GIS factory
 
 4.2.11.0 (2014-10-31)
 - bug       ReferenceError: Table_onover is not defined
 - bug #4552 Incorrect routines display for database due to case insensitive checks
 - bug #4259 reCaptcha sound session expired problem
diff --git a/libraries/gis/GIS_Factory.class.php b/libraries/gis/GIS_Factory.class.php
index b2d01c11a3c3..404a7200857f 100644
--- a/libraries/gis/GIS_Factory.class.php
+++ b/libraries/gis/GIS_Factory.class.php
@@ -31,11 +31,13 @@ class PMA_GIS_Factory
     public static function factory($type)
     {
         include_once './libraries/gis/GIS_Geometry.class.php';
 
         $type_lower = strtolower($type);
-        if (! file_exists('./libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php')) {
+        if (! PMA_isValid($type_lower, PMA_Util::getGISDatatypes())
+            || ! file_exists('./libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php')
+        ) {
             return false;
         }
         if (include_once './libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php') {
             switch(strtoupper($type)) {
             case 'MULTIPOLYGON' :

Vulnerable code:         if (! file_exists('./libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php')) {
Fixed code: - bug #4594 [security] Path traversal in file inclusion of GIS factory
        if (! PMA_isValid($type_lower, PMA_Util::getGISDatatypes())
            || ! file_exists('./libraries/gis/GIS_' . ucfirst($type_lower) . '.class.php')
        ) {
CVE-2014-8960: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-30T11:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/error_report.lib.php
Commit date: 2014-11-20 06:20:49 +0530
Commit message: bug #4596 [security] XSS through exception stack

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index 41efceee0ca8..f5b06e6370cb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,10 +11,11 @@ phpMyAdmin - ChangeLog
 - bug #4586 Javascript error after moving a column
 - bug #4576 Issue with long comments on table columns
 - bug #4599 Input field unnecessarily selected on focus
 - bug #4602 Exporting selected rows exports all rows of the query
 - bug #4444 No insert statement produced in SQL export for queries with alias
+- bug #4596 [security] XSS through exception stack
 
 4.2.11.0 (2014-10-31)
 - bug       ReferenceError: Table_onover is not defined
 - bug #4552 Incorrect routines display for database due to case insensitive checks
 - bug #4259 reCaptcha sound session expired problem
diff --git a/libraries/error_report.lib.php b/libraries/error_report.lib.php
index 80a216eff8bc..8843dfcd31ac 100644
--- a/libraries/error_report.lib.php
+++ b/libraries/error_report.lib.php
@@ -277,11 +277,11 @@ function PMA_getErrorReportForm()
 
     $html .= '<div class="label"><label><p>'
             . __('You may examine the data in the error report:')
             . '</p></label></div>'
             . '<pre class="report-data">'
-            . PMA_getReportData()
+            . htmlspecialchars(PMA_getReportData())
             . '</pre>';
 
     $html .= '<div class="label"><label><p>'
             . __('Please explain the steps that lead to the error:')
             . '</p></label></div>'

Vulnerable code:             . PMA_getReportData()
Fixed code: - bug #4596 [security] XSS through exception stack
            . htmlspecialchars(PMA_getReportData())
CVE-2014-8961: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensitive information about a file's line count via a crafted parameter.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2014-11-30T11:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, libraries/error_report.lib.php
Commit date: 2014-11-20 06:24:34 +0530
Commit message: bug #4595 [security] Path traversal can lead to leakage of line count

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index f5b06e6370cb..29831777c062 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,10 +12,11 @@ phpMyAdmin - ChangeLog
 - bug #4576 Issue with long comments on table columns
 - bug #4599 Input field unnecessarily selected on focus
 - bug #4602 Exporting selected rows exports all rows of the query
 - bug #4444 No insert statement produced in SQL export for queries with alias
 - bug #4596 [security] XSS through exception stack
+- bug #4595 [security] Path traversal can lead to leakage of line count
 
 4.2.11.0 (2014-10-31)
 - bug       ReferenceError: Table_onover is not defined
 - bug #4552 Incorrect routines display for database due to case insensitive checks
 - bug #4259 reCaptcha sound session expired problem
diff --git a/libraries/error_report.lib.php b/libraries/error_report.lib.php
index 8843dfcd31ac..1bc73ef945d0 100644
--- a/libraries/error_report.lib.php
+++ b/libraries/error_report.lib.php
@@ -175,10 +175,23 @@ function PMA_countLines($filename)
     global $LINE_COUNT;
     if (defined('LINE_COUNTS')) {
         return $LINE_COUNT[$filename];
     }
 
+    // ensure that the file is inside the phpMyAdmin folder
+    $depath = 1;
+    foreach (explode('/', $filename) as $part) {
+        if ($part == '..') {
+            $depath--;
+        } elseif ($part != '.') {
+            $depath++;
+        }
+        if ($depath < 0) {
+            return 0;
+        }
+    }
+
     $linecount = 0;
     $handle = fopen('./js/' . $filename, 'r');
     while (!feof($handle)) {
         $line = fgets($handle);
         if ($line === false) {

Fixed code: - bug #4595 [security] Path traversal can lead to leakage of line count
    // ensure that the file is inside the phpMyAdmin folder
    $depath = 1;
    foreach (explode('/', $filename) as $part) {
        if ($part == '..') {
            $depath--;
        } elseif ($part != '.') {
            $depath++;
        }
        if ($depath < 0) {
            return 0;
        }
    }
CVE-2014-9219: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-12-08T11:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, url.php
Commit date: 2014-12-01 21:51:59 +0530
Commit message: bug #4612 [security] XSS vulnerability in redirection mechanism

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index a26b9709acaa..77219f578671 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
+4.2.13.1 (not yet released)
+- bug #4612 [security] XSS vulnerability in redirection mechanism
+
 4.2.13.0 (2014-11-30)
 - bug #4604 Query history not being deleted
 - bug #4057 db/table query string parameters no longer work
 - bug #4605 Unseen messages in tracking
 - bug #4606 Tracking report export as SQL dump does not work
diff --git a/url.php b/url.php
index 71efc9fb6b0a..82b224311be5 100644
--- a/url.php
+++ b/url.php
@@ -9,10 +9,14 @@
 /**
  * Gets core libraries and defines some variables
  */
 define('PMA_MINIMUM_COMMON', true);
 require_once './libraries/common.inc.php';
+/**
+ * JavaScript escaping.
+ */
+require_once './libraries/js_escape.lib.php';
 
 if (! PMA_isValid($_GET['url'])
     || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])
     || ! PMA_isAllowedDomain($_GET['url'])
 ) {
@@ -22,11 +26,11 @@
     //  then web browser sometimes does not change the HTTP_REFERER
     //  field and so with old URL as Referer, token also goes to
     //  external site.
     echo "<script type='text/javascript'>
             window.onload=function(){
-                window.location='" . htmlspecialchars($_GET['url']) . "';
+                window.location='" . PMA_escapeJsString($_GET['url']) . "';
             }
         </script>";
     // Display redirecting msg on screen.
     printf(__('Taking you to %s.'), htmlspecialchars($_GET['url']));
 }

Vulnerable code:                 window.location='" . htmlspecialchars($_GET['url']) . "';
Fixed code: 4.2.13.1 (not yet released)
- bug #4612 [security] XSS vulnerability in redirection mechanism

/**
 * JavaScript escaping.
 */
require_once './libraries/js_escape.lib.php';
                window.location='" . PMA_escapeJsString($_GET['url']) . "';