Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-6419: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-08-07T03:29Z
Repository: https://github.com/vrtadmin/clamav-devel
Language: C
Files changed: libclamav/libmspack-0.5alpha/mspack/lzxd.c, libclamav/libmspack.c
Commit date: 2017-03-29 14:58:11 -0400
Commit message: fixing potential OOB window write when unpacking chm files

Diff: diff --git a/libclamav/libmspack-0.5alpha/mspack/lzxd.c b/libclamav/libmspack-0.5alpha/mspack/lzxd.c
index 2281e7b9d3..45105a583d 100644
--- a/libclamav/libmspack-0.5alpha/mspack/lzxd.c
+++ b/libclamav/libmspack-0.5alpha/mspack/lzxd.c
@@ -764,12 +764,17 @@ int lzxd_decompress(struct lzxd_stream *lzx, off_t out_bytes) {
 	break;
 
       case LZX_BLOCKTYPE_UNCOMPRESSED:
 	/* as this_run is limited not to wrap a frame, this also means it
 	 * won't wrap the window (as the window is a multiple of 32k) */
+        if (window_posn + this_run > lzx->window_size) {
+                D(("match ran over window boundary"))
+                return lzx->error = MSPACK_ERR_DECRUNCH;
+        }
 	rundest = &window[window_posn];
 	window_posn += this_run;
+
 	while (this_run > 0) {
 	  if ((i = i_end - i_ptr) == 0) {
 	    READ_IF_NEEDED;
 	  }
 	  else {
@@ -886,10 +891,12 @@ int lzxd_decompress(struct lzxd_stream *lzx, off_t out_bytes) {
 
 void lzxd_free(struct lzxd_stream *lzx) {
   struct mspack_system *sys;
   if (lzx) {
     sys = lzx->sys;
-    sys->free(lzx->inbuf);
-    sys->free(lzx->window);
+    if(lzx->inbuf)
+        sys->free(lzx->inbuf);
+    if(lzx->window)
+        sys->free(lzx->window);
     sys->free(lzx);
   }
 }
diff --git a/libclamav/libmspack.c b/libclamav/libmspack.c
index d9b05ec257..22bc1a11ee 100644
--- a/libclamav/libmspack.c
+++ b/libclamav/libmspack.c
@@ -262,11 +262,15 @@ static void *mspack_fmap_alloc(struct mspack_system *self, size_t num)
 	return malloc(num);
 }
 
 static void mspack_fmap_free(void *mem)
 {
-	free(mem);
+    if(mem) {
+        free(mem);
+        mem = NULL;
+    }
+    return;
 }
 
 static void mspack_fmap_copy(void *src, void *dst, size_t num)
 {
 	memcpy(dst, src, num);

Vulnerable code:     sys->free(lzx->inbuf);
    sys->free(lzx->window);
	free(mem);
Fixed code:         if (window_posn + this_run > lzx->window_size) {
                D(("match ran over window boundary"))
                return lzx->error = MSPACK_ERR_DECRUNCH;
        }

    if(lzx->inbuf)
        sys->free(lzx->inbuf);
    if(lzx->window)
        sys->free(lzx->window);
    if(mem) {
        free(mem);
        mem = NULL;
    }
    return;
CVE-2017-6420: Use After Free (CWE-416)
value: The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2017-08-07T03:29Z
Repository: https://github.com/vrtadmin/clamav-devel
Language: C
Files changed: libclamav/wwunpack.c
Commit date: 2017-03-03 13:56:28 -0500
Commit message: bb19798 - fix out of bound memory access for crafted wwunpack file.

Diff: diff --git a/libclamav/wwunpack.c b/libclamav/wwunpack.c
index 8611cb6041..38c18081ce 100644
--- a/libclamav/wwunpack.c
+++ b/libclamav/wwunpack.c
@@ -224,10 +224,16 @@ int wwunpack(uint8_t *exe, uint32_t exesz, uint8_t *wwsect, struct cli_exe_secti
     if (pe+6 > exesz || pe+7 > exesz || pe+0x28 > exesz ||
 		pe+0x50 > exesz || pe+0x14 > exesz) 
 	return CL_EFORMAT;
     exe[pe+6]=(uint8_t)scount;
     exe[pe+7]=(uint8_t)(scount>>8);
+    if (!CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295, 4) ||
+        !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva, 4) ||
+        !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva+0x299, 4)) {
+        cli_dbgmsg("WWPack: unpack memory address out of bounds.\n");
+        return CL_EFORMAT;
+    }
     cli_writeint32(&exe[pe+0x28], cli_readint32(wwsect+0x295)+sects[scount].rva+0x299);
     cli_writeint32(&exe[pe+0x50], cli_readint32(&exe[pe+0x50])-sects[scount].vsz);
 
     structs = &exe[(0xffff&cli_readint32(&exe[pe+0x14]))+pe+0x18];
     for(i=0 ; i<scount ; i++) {

Fixed code:     if (!CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295, 4) ||
        !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva, 4) ||
        !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva+0x299, 4)) {
        cli_dbgmsg("WWPack: unpack memory address out of bounds.\n");
        return CL_EFORMAT;
    }
CVE-2013-2091: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2019-11-20T20:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/adherents/fiche.php
Commit date: 2013-05-10 15:04:16 +0200
Commit message: Fix security breach (SQL injection)

Diff: diff --git a/htdocs/adherents/fiche.php b/htdocs/adherents/fiche.php
index 02e0af3a76..57aa72e70c 100644
--- a/htdocs/adherents/fiche.php
+++ b/htdocs/adherents/fiche.php
@@ -956,14 +956,15 @@ else
 		}
 
 		$adht = new AdherentType($db);
 		$adht->fetch($object->typeid);
 
+		$country=GETPOST('pays','int');
 		// We set country_id, and country_code, country of the chosen country
-		if (isset($_POST["pays"]) || $object->country_id)
+		if (!empty($country) || $object->country_id)
 		{
-			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(isset($_POST["pays"])?$_POST["pays"]:$object->country_id);
+			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(!empty($country)?$country:$object->country_id);
 			$resql=$db->query($sql);
 			if ($resql)
 			{
 				$obj = $db->fetch_object($resql);
 			}

Vulnerable code: 		if (isset($_POST["pays"]) || $object->country_id)
			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(isset($_POST["pays"])?$_POST["pays"]:$object->country_id);
Fixed code: 		$country=GETPOST('pays','int');
		if (!empty($country) || $object->country_id)
			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(!empty($country)?$country:$object->country_id);
CVE-2013-2092: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-11-20T21:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/core/lib/functions.lib.php
Commit date: 2013-05-11 15:12:42 +0200
Commit message: Fix: Escape entities
Diff: diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php
index 71dbfbc1b2b..bacda98845d 100644
--- a/htdocs/core/lib/functions.lib.php
+++ b/htdocs/core/lib/functions.lib.php
@@ -2098,14 +2098,14 @@ function dol_print_error($db='',$error='')
 		if (function_exists("phpversion"))
 		{
 			$out.="<b>".$langs->trans("PHP").":</b> ".phpversion()."<br>\n";
 			//phpinfo();       // This is to show location of php.ini file
 		}
-		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";;
+		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";
 		$out.="<br>\n";
-		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".$_SERVER["REQUEST_URI"]."<br>\n";;
-		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:'')."<br>\n";;
+		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".dol_htmlentities($_SERVER["REQUEST_URI"],ENT_COMPAT,'UTF-8')."<br>\n";
+		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?dol_htmlentities($_SERVER["HTTP_REFERER"],ENT_COMPAT,'UTF-8'):'')."<br>\n";
 		$out.="<b>".$langs->trans("MenuManager").":</b> ".$conf->top_menu."<br>\n";
 		$out.="<br>\n";
 		$syslog.="url=".$_SERVER["REQUEST_URI"];
 		$syslog.=", query_string=".$_SERVER["QUERY_STRING"];
 	}

Vulnerable code: 		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";;
		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".$_SERVER["REQUEST_URI"]."<br>\n";;
		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:'')."<br>\n";;
Fixed code: 		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";
		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".dol_htmlentities($_SERVER["REQUEST_URI"],ENT_COMPAT,'UTF-8')."<br>\n";
		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?dol_htmlentities($_SERVER["HTTP_REFERER"],ENT_COMPAT,'UTF-8'):'')."<br>\n";
CVE-2018-10094: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2018-05-22T20:29Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/adherents/list.php
Commit date: 2018-04-18 12:23:49 +0200
Commit message: FIX CVE-2018-10094
Diff: diff --git a/htdocs/adherents/list.php b/htdocs/adherents/list.php
index cae878829b71..68062b895a09 100644
--- a/htdocs/adherents/list.php
+++ b/htdocs/adherents/list.php
@@ -41,11 +41,11 @@ $toselect = GETPOST('toselect', 'array');
 
 // Security check
 $result=restrictedArea($user,'adherent');
 
 $filter=GETPOST("filter",'alpha');
-$statut=GETPOST("statut",'alpha');
+$statut=GETPOST("statut",'intcomma');
 $search=GETPOST("search",'alpha');
 $search_ref=GETPOST("search_ref",'alpha');
 $search_lastname=GETPOST("search_lastname",'alpha');
 $search_firstname=GETPOST("search_firstname",'alpha');
 $search_login=GETPOST("search_login",'alpha');

Vulnerable code: $statut=GETPOST("statut",'alpha');
Fixed code: $statut=GETPOST("statut",'intcomma');
CVE-2018-10095: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-05-22T20:29Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/adherents/cartes/carte.php
Commit date: 2018-04-18 12:32:19 +0200
Commit message: FIX CVE-2018-10095
Diff: diff --git a/htdocs/adherents/cartes/carte.php b/htdocs/adherents/cartes/carte.php
index 59713e20573b..05b71ba1360b 100644
--- a/htdocs/adherents/cartes/carte.php
+++ b/htdocs/adherents/cartes/carte.php
@@ -27,23 +27,22 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/format_cards.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/adherents/class/adherent.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/modules/member/modules_cards.php';
 require_once DOL_DOCUMENT_ROOT.'/core/modules/printsheet/modules_labels.php';
 
-$langs->load("members");
-$langs->load("errors");
+$langs->loadLangs(array("members","errors"));
 
 // Choix de l'annee d'impression ou annee courante.
 $now = dol_now();
 $year=dol_print_date($now,'%Y');
 $month=dol_print_date($now,'%m');
 $day=dol_print_date($now,'%d');
-$foruserid=GETPOST('foruserid');
-$foruserlogin=GETPOST('foruserlogin');
-$mode=GETPOST('mode');
-$model=GETPOST("model");			// Doc template to use for business cards
-$modellabel=GETPOST("modellabel");	// Doc template to use for address sheet
+$foruserid=GETPOST('foruserid','alphanohtml');
+$foruserlogin=GETPOST('foruserlogin','alphanohtml');
+$mode=GETPOST('mode','aZ09');
+$model=GETPOST("model",'aZ09');				// Doc template to use for business cards
+$modellabel=GETPOST("modellabel",'aZ09');	// Doc template to use for address sheet
 $mesg='';
 
 $adherentstatic=new Adherent($db);
 
 $extrafields = new ExtraFields($db);

Vulnerable code: $langs->load("members");
$langs->load("errors");
$foruserid=GETPOST('foruserid');
$foruserlogin=GETPOST('foruserlogin');
$mode=GETPOST('mode');
$model=GETPOST("model");			// Doc template to use for business cards
$modellabel=GETPOST("modellabel");	// Doc template to use for address sheet
Fixed code: $langs->loadLangs(array("members","errors"));
$foruserid=GETPOST('foruserid','alphanohtml');
$foruserlogin=GETPOST('foruserlogin','alphanohtml');
$mode=GETPOST('mode','aZ09');
$model=GETPOST("model",'aZ09');				// Doc template to use for business cards
$modellabel=GETPOST("modellabel",'aZ09');	// Doc template to use for address sheet
CVE-2020-14475: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-06-19T17:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/public/notice.php
Commit date: 2020-06-19 00:39:27 +0200
Commit message: Fix XSS reported by C. Weiler <sak1.s3curity@gmail.com> in notice.php
Diff: diff --git a/htdocs/public/notice.php b/htdocs/public/notice.php
index 43344c376aa9..9663bff3cf0a 100644
--- a/htdocs/public/notice.php
+++ b/htdocs/public/notice.php
@@ -39,11 +39,10 @@ if (! GETPOST('transkey', 'alphanohtml') && ! GETPOST('transphrase', 'alphanohtm
     print 'Sorry, it seems your internet connexion is off.<br>';
     print 'You need to be connected to network to use this software.<br>';
 }
 else
 {
-    $langs->load("error");
-    $langs->load("other");
+    $langs->loadLangs(array("error", "other"));
 
-    if (GETPOST('transphrase', 'alphanohtml')) print GETPOST('transphrase', 'alphanohtml');
-    if (GETPOST('transkey', 'alphanohtml')) print $langs->trans(GETPOST('transkey', 'alphanohtml'));
+    if (GETPOST('transphrase', 'alphanohtml')) print dol_escape_htmltag(GETPOST('transphrase', 'alphanohtml'));
+    elseif (GETPOST('transkey', 'alphanohtml')) print dol_escape_htmltag($langs->trans(GETPOST('transkey', 'alphanohtml')));
 }

Vulnerable code:     $langs->load("error");
    $langs->load("other");
    if (GETPOST('transphrase', 'alphanohtml')) print GETPOST('transphrase', 'alphanohtml');
    if (GETPOST('transkey', 'alphanohtml')) print $langs->trans(GETPOST('transkey', 'alphanohtml'));
Fixed code:     $langs->loadLangs(array("error", "other"));
    if (GETPOST('transphrase', 'alphanohtml')) print dol_escape_htmltag(GETPOST('transphrase', 'alphanohtml'));
    elseif (GETPOST('transkey', 'alphanohtml')) print dol_escape_htmltag($langs->trans(GETPOST('transkey', 'alphanohtml')));
CVE-2021-25957: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 8.8
Published: 2021-08-17T15:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/user/passwordforgotten.php
Commit date: 2021-07-05 17:29:10 +0200
Commit message: Fix report by Ahsan Aziz (can reset the password of another user that
did not request password reset).
Diff: diff --git a/htdocs/user/passwordforgotten.php b/htdocs/user/passwordforgotten.php
index cb149f1e481e..63f33b5f8ec7 100644
--- a/htdocs/user/passwordforgotten.php
+++ b/htdocs/user/passwordforgotten.php
@@ -85,18 +85,18 @@ if ($reshook < 0) {
 
 if (empty($reshook)) {
 	// Validate new password
 	if ($action == 'validatenewpassword' && $username && $passworduidhash) {
 		$edituser = new User($db);
-		$result = $edituser->fetch('', $_GET["username"]);
+		$result = $edituser->fetch('', $username);
 		if ($result < 0) {
 			$message = '<div class="error">'.dol_escape_htmltag($langs->trans("ErrorLoginDoesNotExists", $username)).'</div>';
 		} else {
 			global $dolibarr_main_instance_unique_id;
 
 			//print $edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id.' '.$passworduidhash;
-			if (dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id, $passworduidhash)) {
+			if ($edituser->pass_temp && dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id, $passworduidhash)) {
 				// Clear session
 				unset($_SESSION['dol_login']);
 				$_SESSION['dol_loginmesg'] = $langs->trans('NewPasswordValidated'); // Save message for the session page
 
 				$newpassword = $edituser->setPassword($user, $edituser->pass_temp, 0);

Vulnerable code: 		$result = $edituser->fetch('', $_GET["username"]);
			if (dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id, $passworduidhash)) {
Fixed code: 		$result = $edituser->fetch('', $username);
			if ($edituser->pass_temp && dol_verifyHash($edituser->pass_temp.'-'.$edituser->id.'-'.$dolibarr_main_instance_unique_id, $passworduidhash)) {
CVE-2021-37517: Incorrect Authorization (CWE-863)
value: An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 7.5
Published: 2022-03-31T19:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/user/card.php, htdocs/user/class/user.class.php
Commit date: 2021-07-20 22:42:23 +0200
Commit message: Fix Improper Authorization Check reported by Ahsan Aziz.
Diff: diff --git a/htdocs/user/card.php b/htdocs/user/card.php
index 152c39f79acbd..996425c069434 100644
--- a/htdocs/user/card.php
+++ b/htdocs/user/card.php
@@ -312,12 +312,12 @@ if (empty($reshook)) {
 
 			$db->begin();
 
 			$id = $object->create($user);
 			if ($id > 0) {
-				if (GETPOST('password')) {
-					$object->setPassword($user, GETPOST('password'));
+				if (GETPOST('password', 'none')) {
+					$object->setPassword($user, GETPOST('password','none'));
 				}
 				if (!empty($conf->categorie->enabled)) {
 					// Categories association
 					$usercats = GETPOST('usercats', 'array');
 					$object->setCategories($usercats);
diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php
index 74137537e7495..6d8ff911feb27 100644
--- a/htdocs/user/class/user.class.php
+++ b/htdocs/user/class/user.class.php
@@ -1278,10 +1278,14 @@ class User extends CommonObject
 		}
 		if (empty($this->login)) {
 			$langs->load("errors");
 			$this->error = $langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("Login"));
 			return -1;
+		} elseif (preg_match('/[,@<>"\']/', $this->login)) {
+		    $langs->load("errors");
+		    $this->error = $langs->trans("ErrorBadCharIntoLoginName");
+		    return -1;
 		}
 
 		$this->datec = dol_now();
 
 		$error = 0;
@@ -1667,10 +1671,14 @@ class User extends CommonObject
 		}
 		if (empty($this->login)) {
 			$langs->load("errors");
 			$this->error = $langs->trans("ErrorFieldRequired", 'Login');
 			return -1;
+		} elseif (preg_match('/[,@<>"\']/', $this->login)) {
+		    $langs->load("errors");
+		    $this->error = $langs->trans("ErrorBadCharIntoLoginName");
+		    return -1;
 		}
 
 		$this->db->begin();
 
 		// Check if login already exists in same entity or into entity 0.

Vulnerable code: 				if (GETPOST('password')) {
					$object->setPassword($user, GETPOST('password'));
Fixed code: 				if (GETPOST('password', 'none')) {
					$object->setPassword($user, GETPOST('password','none'));
		} elseif (preg_match('/[,@<>"\']/', $this->login)) {
		    $langs->load("errors");
		    $this->error = $langs->trans("ErrorBadCharIntoLoginName");
		    return -1;
		} elseif (preg_match('/[,@<>"\']/', $this->login)) {
		    $langs->load("errors");
		    $this->error = $langs->trans("ErrorBadCharIntoLoginName");
		    return -1;
CVE-2023-33568: Files or Directories Accessible to External Parties (CWE-552)
value: An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
CWE description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
CVSS v3 base score: 7.5
Published: 2023-06-13T15:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/public/ticket/ajax/ajax.php
Commit date: 2023-03-17 06:43:15 +0100
Commit message: FIX FILTER_VALIDATE_EMAIL param is not a string
Diff: diff --git a/htdocs/public/ticket/ajax/ajax.php b/htdocs/public/ticket/ajax/ajax.php
index 79c4b5bf530a8..9092bf37b7716 100644
--- a/htdocs/public/ticket/ajax/ajax.php
+++ b/htdocs/public/ticket/ajax/ajax.php
@@ -53,11 +53,11 @@ if (!defined('NOBROWSERNOTIF')) {
 
 include_once '../../../main.inc.php'; // Load $user and permissions
 
 $action = GETPOST('action', 'aZ09');
 $id = GETPOST('id', 'int');
-$email = GETPOST('email', 'custom', 0, 'FILTER_VALIDATE_EMAIL');
+$email = GETPOST('email', 'custom', 0, FILTER_VALIDATE_EMAIL);
 
 
 if (!isModEnabled('ticket')) {
 	accessforbidden('', 0, 0, 1);
 }

Vulnerable code: $email = GETPOST('email', 'custom', 0, 'FILTER_VALIDATE_EMAIL');
Fixed code: $email = GETPOST('email', 'custom', 0, FILTER_VALIDATE_EMAIL);
CVE-2023-33568: Files or Directories Accessible to External Parties (CWE-552)
value: An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
CWE description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
CVSS v3 base score: 7.5
Published: 2023-06-13T15:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/public/ticket/ajax/ajax.php
Commit date: 2023-02-21 20:50:26 +0100
Commit message: Fix regression
Diff: diff --git a/htdocs/public/ticket/ajax/ajax.php b/htdocs/public/ticket/ajax/ajax.php
index 0ddc65299961a..e125b0122e7b6 100644
--- a/htdocs/public/ticket/ajax/ajax.php
+++ b/htdocs/public/ticket/ajax/ajax.php
@@ -55,16 +55,17 @@ include_once '../../../main.inc.php'; // Load $user and permissions
 
 $action = GETPOST('action', 'aZ09');
 $id = GETPOST('id', 'int');
 $email = GETPOST('email', 'alphanohtml');
 
+
 if (!isModEnabled('ticket')) {
-	httponly_accessforbidden('Module Ticket not enabled');
+	accessforbidden('', 0, 0, 1);
 }
 
 if (empty($conf->global->TICKET_CREATE_THIRD_PARTY_WITH_CONTACT_IF_NOT_EXIST)) {
-	httponly_accessforbidden('Option TICKET_CREATE_THIRD_PARTY_WITH_CONTACT_IF_NOT_EXIST of module ticket is not enabled');
+	accessforbidden('', 0, 0, 1);
 }
 
 
 /*
  * View

Vulnerable code: 	httponly_accessforbidden('Module Ticket not enabled');
	httponly_accessforbidden('Option TICKET_CREATE_THIRD_PARTY_WITH_CONTACT_IF_NOT_EXIST of module ticket is not enabled');
Fixed code: 
	accessforbidden('', 0, 0, 1);
	accessforbidden('', 0, 0, 1);
CVE-2023-31123: Improper Authentication (CWE-287)
value: `effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, any user with an account on an instance of `effectindex/tripreporter`, e.g. `subjective.report`, may be affected by an improper password verification vulnerability. The vulnerability allows any user with a password matching the password requirements to log in as any user. This allows access to accounts / data loss of the user. This issue is patched in commit bd80ba833b9023d39ca22e29874296c8729dd53b. No action necessary for users of `subjective.report`, and anyone running their own instance should update to this commit or newer as soon as possible. As a workaround, someone running their own instance may apply the patch manually.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.1
Published: 2023-05-08T21:15Z
Repository: https://github.com/effectindex/tripreporter
Language: Go
Files changed: api/account.go
Commit date: 2023-04-30 14:04:47 +0200
Commit message: api: (account) Fix improper password verification

Diff: diff --git a/api/account.go b/api/account.go
index be89603..b9c08a0 100644
--- a/api/account.go
+++ b/api/account.go
@@ -82,11 +82,11 @@ func AccountPostLogin(w http.ResponseWriter, r *http.Request) {
 	if err != nil {
 		ctx.HandleStatus(w, r, err.Error(), http.StatusBadRequest)
 		return
 	}
 
-	account, err = a1.ValidatePassword(account.Password, "Password")
+	account, err = a1.VerifyPassword(account.Password)
 	if err != nil {
 		ctx.HandleStatus(w, r, "Invalid username or password!", http.StatusForbidden)
 		return
 	}
 

Vulnerable code: 	account, err = a1.ValidatePassword(account.Password, "Password")
Fixed code: 	account, err = a1.VerifyPassword(account.Password)
CVE-2021-31873: Integer Overflow or Wraparound (CWE-190)
value: An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap buffer overflow.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2021-04-30T06:15Z
Repository: https://github.com/huolinjue/klibc
Language: C
Files changed: usr/klibc/malloc.c
Commit date: 2021-04-29 16:01:54 +0200
Commit message: [klibc] malloc: Fail if requested size > PTRDIFF_MAX

malloc() adds some overhead to the requested size, which may result in
an integer overflow and subsequent buffer overflow if it is close to
SIZE_MAX.  It should fail if size is large enough for this to happen.

Further, it's not legal for a C object to be larger than
PTRDIFF_MAX (half of SIZE_MAX) as pointer arithmetic within it could
overflow.  So return failure immediately if size is greater than that.

CVE-2021-31873

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

Diff: diff --git a/usr/klibc/malloc.c b/usr/klibc/malloc.c
index bb57c9f6..abda84c2 100644
--- a/usr/klibc/malloc.c
+++ b/usr/klibc/malloc.c
@@ -145,10 +145,19 @@ void *malloc(size_t size)
 	size_t fsize;
 
 	if (size == 0)
 		return NULL;
 
+	/* Various additions below will overflow if size is close to
+	   SIZE_MAX.  Further, it's not legal for a C object to be
+	   larger than PTRDIFF_MAX (half of SIZE_MAX) as pointer
+	   arithmetic within it could overflow. */
+	if (size > PTRDIFF_MAX) {
+		errno = ENOMEM;
+		return NULL;
+	}
+
 	/* Add the obligatory arena header, and round up */
 	size = (size + 2 * sizeof(struct arena_header) - 1) & ARENA_SIZE_MASK;
 
 	for (fp = __malloc_head.next_free; fp->a.type != ARENA_TYPE_HEAD;
 	     fp = fp->next_free) {

Fixed code: 	/* Various additions below will overflow if size is close to
	   SIZE_MAX.  Further, it's not legal for a C object to be
	   larger than PTRDIFF_MAX (half of SIZE_MAX) as pointer
	   arithmetic within it could overflow. */
	if (size > PTRDIFF_MAX) {
		errno = ENOMEM;
		return NULL;
	}
CVE-2024-34062: Insufficient Information (NVD-CWE-noinfo)
value: tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-03T10:15Z
Repository: https://github.com/tqdm/tqdm
Language: Unknown
Commit date: 2024-05-02 22:35:59 +0100
Commit message: Merge pull request from GHSA-g7vv-2v7x-gj9p

cli: eval safety
CVE-2018-9840: Insufficient Information (NVD-CWE-noinfo)
value: The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.8
Published: 2018-04-10T05:29Z
Repository: https://github.com/signalapp/Signal-iOS
Language: Unknown
Commit date: 2018-04-06 13:50:52 -0400
Commit message: Merge remote-tracking branch 'origin/charlesmchen/screenLockRework_' into release/2.23.2
CVE-2012-1118: Permissions, Privileges, and Access Controls (CWE-264)
value: The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2012-06-29T19:55Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/access_api.php
Commit date: 2012-02-28 01:40:19 +0100
Commit message: Fix bug in access_has_bug_level() for private issues

When private_bug_threshold is defined as an array instead of a single
access level, e.g. array(0=>40, 1=>70, 2=>90) to prevent developers
from seeing private bugs while granting that privilege to updaters,
access_has_bug_level() incorrectly returned true.

The consequence is that unwanted access to Private bugs was granted to
users who are allowed to view them, e.g. allowing them to delete or
perform other restricted actions.

Fixes #10124

Diff: diff --git a/core/access_api.php b/core/access_api.php
index a94b291f..c05ad005 100644
--- a/core/access_api.php
+++ b/core/access_api.php
@@ -418,14 +418,16 @@ function access_has_bug_level( $p_access_level, $p_bug_id, $p_user_id = null ) {
 	$t_limit_reporters = config_get( 'limit_reporters' );
 	if(( ON === $t_limit_reporters ) && ( !bug_is_user_reporter( $p_bug_id, $p_user_id ) ) && ( !access_has_project_level( REPORTER + 1, $t_project_id, $p_user_id ) ) ) {
 		return false;
 	}
 
-	# If the bug is private and the user is not the reporter, then the
-	#  the user must also have higher access than private_bug_threshold
+	# If the bug is private and the user is not the reporter, then
+	# they must also have higher access than private_bug_threshold
 	if( VS_PRIVATE == bug_get_field( $p_bug_id, 'view_state' ) && !bug_is_user_reporter( $p_bug_id, $p_user_id ) ) {
-		$p_access_level = max( $p_access_level, config_get( 'private_bug_threshold' ) );
+		$t_access_level = access_get_project_level( $t_project_id, $p_user_id );
+		return access_compare_level( $t_access_level, config_get( 'private_bug_threshold' ) )
+		    && access_compare_level( $t_access_level, $p_access_level );
 	}
 
 	return access_has_project_level( $p_access_level, $t_project_id, $p_user_id );
 }
 

Vulnerable code: 	# If the bug is private and the user is not the reporter, then the
	#  the user must also have higher access than private_bug_threshold
		$p_access_level = max( $p_access_level, config_get( 'private_bug_threshold' ) );
Fixed code: 	# If the bug is private and the user is not the reporter, then
	# they must also have higher access than private_bug_threshold
		$t_access_level = access_get_project_level( $t_project_id, $p_user_id );
		return access_compare_level( $t_access_level, config_get( 'private_bug_threshold' ) )
		    && access_compare_level( $t_access_level, $p_access_level );
CVE-2012-1119: Permissions, Privileges, and Access Controls (CWE-264)
value: MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2012-06-29T19:55Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: core/bug_api.php
Commit date: 2012-03-02 16:31:48 +0100
Commit message: Add "New Issue" entry to history when copying bugs

When bug_copy() is called with p_copy_history=false, a 'NEW_BUG' history
entry is added to ensure consistency of behavior with Clone button.

Fixes #13816

Diff: diff --git a/core/bug_api.php b/core/bug_api.php
index 149433702..480b1dee9 100644
--- a/core/bug_api.php
+++ b/core/bug_api.php
@@ -1035,10 +1035,12 @@ function bug_copy( $p_bug_id, $p_target_project_id = null, $p_copy_custom_fields
 	}
 
 	# COPY HISTORY
 	history_delete( $t_new_bug_id );	# should history only be deleted inside the if statement below?
 	if( $p_copy_history ) {
+		# @todo problem with this code: the generated history trail is incorrect because the note IDs are those of the original bug, not the copied ones
+		# @todo actually, does it even make sense to copy the history ?
 		$query = "SELECT *
 					  FROM $t_mantis_bug_history_table
 					  WHERE bug_id = " . db_param();
 		$result = db_query_bound( $query, Array( $t_bug_id ) );
 		$t_count = db_num_rows( $result );
@@ -1054,10 +1056,13 @@ function bug_copy( $p_bug_id, $p_target_project_id = null, $p_copy_custom_fields
 						  		   " . db_param() . ",
 						  		   " . db_param() . ",
 						  		   " . db_param() . " );";
 			db_query_bound( $query, Array( $t_bug_history['user_id'], $t_new_bug_id, $t_bug_history['date_modified'], $t_bug_history['field_name'], $t_bug_history['old_value'], $t_bug_history['new_value'], $t_bug_history['type'] ) );
 		}
+	} else {
+		# Create a "New Issue" history entry
+		history_log_event_special( $t_new_bug_id, NEW_BUG );
 	}
 
 	# Create history entries to reflect the copy operation
 	history_log_event_special( $t_new_bug_id, BUG_CREATED_FROM, '', $t_bug_id );
 	history_log_event_special( $t_bug_id, BUG_CLONED_TO, '', $t_new_bug_id );

Fixed code: 		# @todo problem with this code: the generated history trail is incorrect because the note IDs are those of the original bug, not the copied ones
		# @todo actually, does it even make sense to copy the history ?
	} else {
		# Create a "New Issue" history entry
		history_log_event_special( $t_new_bug_id, NEW_BUG );
CVE-2012-1122: Permissions, Privileges, and Access Controls (CWE-264)
value: bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2012-06-29T19:55Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: bug_actiongroup.php
Commit date: 2012-01-09 14:20:02 +0100
Commit message: Fix Move bugs from projects with access < report_bug_threshold

The access check in bug_actiongroup.php was not correct. It should
verify the user's report_bug_threshold in the target project, not the
current project.

Fixes #13748

Diff: diff --git a/bug_actiongroup.php b/bug_actiongroup.php
index 7a4b89ad3..c68a07fb1 100644
--- a/bug_actiongroup.php
+++ b/bug_actiongroup.php
@@ -134,12 +134,12 @@ foreach( $f_bug_arr as $t_bug_id ) {
 		}
 		break;
 
 	case 'MOVE':
 		$f_project_id = gpc_get_int( 'project_id' );
-		if ( access_has_bug_level( config_get( 'move_bug_threshold' ), $t_bug_id ) &&
-		     access_has_project_level( config_get( 'report_bug_threshold' ), $f_project_id ) ) {
+		if( access_has_bug_level( config_get( 'move_bug_threshold' ), $t_bug_id ) &&
+		    access_has_project_level( config_get( 'report_bug_threshold', null, null, $f_project_id ), $f_project_id ) ) {
 			/** @todo we need to issue a helper_call_custom_function( 'issue_update_validate', array( $t_bug_id, $t_bug_data, $f_bugnote_text ) ); */
 			bug_move( $t_bug_id, $f_project_id );
 			helper_call_custom_function( 'issue_update_notify', array( $t_bug_id ) );
 		} else {
 			$t_failed_ids[$t_bug_id] = lang_get( 'bug_actiongroup_access' );

Vulnerable code: 		if ( access_has_bug_level( config_get( 'move_bug_threshold' ), $t_bug_id ) &&
		     access_has_project_level( config_get( 'report_bug_threshold' ), $f_project_id ) ) {
Fixed code: 		if( access_has_bug_level( config_get( 'move_bug_threshold' ), $t_bug_id ) &&
		    access_has_project_level( config_get( 'report_bug_threshold', null, null, $f_project_id ), $f_project_id ) ) {
CVE-2012-1123: Improper Authentication (CWE-287)
value: The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Published: 2012-06-29T19:55Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: api/soap/mc_api.php
Commit date: 2012-02-16 09:41:56 +0000
Commit message: Fix 0013901: SOAP API allows invoking methods without proper authentication

Note: only applied to 1.2.x not 'next', as the code is changing anyway

Diff: diff --git a/api/soap/mc_api.php b/api/soap/mc_api.php
index 507680f49..a81781ae1 100644
--- a/api/soap/mc_api.php
+++ b/api/soap/mc_api.php
@@ -49,10 +49,15 @@ function mci_check_login( $p_username, $p_password ) {
 
 		$p_username = config_get( 'anonymous_account' );
 
 		# do not use password validation.
 		$p_password = null;
+	} else {
+		if( is_blank( $p_password ) ) {
+			# require password for authenticated access
+			return false;
+		}
 	}
 
 	if( false === auth_attempt_script_login( $p_username, $p_password ) ) {
 		return false;
 	}

Fixed code: 	} else {
		if( is_blank( $p_password ) ) {
			# require password for authenticated access
			return false;
		}
CVE-2013-4460: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-01-10T15:55Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: account_sponsor_page.php
Commit date: 2013-10-19 20:36:16 +0200
Commit message: Fix #16513: XSS in account_sponsor_page.php project names

account_sponsor_page.php.php does not correctly sanitise project
names. It is thus possible for a malicious user with project
manager access permissions (or higher) to let users execute
malicious JavaScript when visiting account_sponsor_page.php.

Diff: diff --git a/account_sponsor_page.php b/account_sponsor_page.php
index 8aa3a6622..67c12d328 100644
--- a/account_sponsor_page.php
+++ b/account_sponsor_page.php
@@ -178,11 +178,11 @@ if ( $t_sponsor_count === 0 ) {
 		# choose color based on status
 		$status_label = html_get_status_css_class( $t_bug->status, auth_get_current_user_id(), $t_bug->project_id );
 
 		echo '<tr class="' . $status_label .  '">';
 		echo '<td><a href="' . string_get_bug_view_url( $row['bug'] ) . '">' . bug_format_id( $row['bug'] ) . '</a></td>';
-		echo '<td>' . project_get_field( $t_bug->project_id, 'name' ) . '&#160;</td>';
+		echo '<td>' . string_display_line( project_get_field( $t_bug->project_id, 'name' ) ) . '&#160;</td>';
 		echo '<td class="right">' . $t_released_label . '&#160;</td>';
 		echo '<td><span class="issue-status" title="' . $t_resolution . '">' . $t_status . '</span></td>';
 		echo '<td>';
 		print_user( $t_bug->handler_id );
 		echo '</td>';
@@ -297,11 +297,11 @@ if ( $t_sponsor_count === 0 ) {
 		# choose color based on status
 		$status_label = html_get_status_css_class( $t_bug->status, auth_get_current_user_id(), $t_bug->project_id );
 
 		echo '<tr class="' . $status_label .  '">';
 		echo '<td><a href="' . string_get_bug_view_url( $row['bug'] ) . '">' . bug_format_id( $row['bug'] ) . '</a></td>';
-		echo '<td>' . project_get_field( $t_bug->project_id, 'name' ) . '&#160;</td>';
+		echo '<td>' . string_display_line( project_get_field( $t_bug->project_id, 'name' ) ) . '&#160;</td>';
 		echo '<td class="right">' . $t_released_label . '&#160;</td>';
 		echo '<td><a title="' . $t_resolution . '"><span class="underline">' . $t_status . '</span>&#160;</a></td>';
 
 		# summary
 		echo '<td>' . string_display_line( $t_bug->summary );

Vulnerable code: 		echo '<td>' . project_get_field( $t_bug->project_id, 'name' ) . '&#160;</td>';
		echo '<td>' . project_get_field( $t_bug->project_id, 'name' ) . '&#160;</td>';
Fixed code: 		echo '<td>' . string_display_line( project_get_field( $t_bug->project_id, 'name' ) ) . '&#160;</td>';
		echo '<td>' . string_display_line( project_get_field( $t_bug->project_id, 'name' ) ) . '&#160;</td>';
CVE-2014-8986: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via a crafted config option, a different vulnerability than CVE-2014-8987.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-24T15:59Z
Repository: https://github.com/mantisbt/mantisbt
Language: PHP
Files changed: adm_config_report.php
Commit date: 2014-08-08 23:01:21 +0100
Commit message: Fix: adm_config_report.php filtering does not check config option is valid

I've left this throwing ERROR_GENERIC as the only time this should be able
to be hit is if we have invalid input to start with.

Diff: diff --git a/adm_config_report.php b/adm_config_report.php
index 6288a7ff81..83149f0e42 100644
--- a/adm_config_report.php
+++ b/adm_config_report.php
@@ -180,10 +180,11 @@ if( $t_filter_save ) {
 	);
 	gpc_set_cookie( $t_cookie_name, $t_cookie_string, true );
 } else {
 	# Retrieve the filter from the cookie if it exists
 	$t_cookie_string = gpc_get_cookie( $t_cookie_name, null );
+
 	if( null !== $t_cookie_string ) {
 		$t_cookie_contents = explode( ':', $t_cookie_string );
 
 		$t_filter_user_value    = $t_cookie_contents[0];
 		$t_filter_project_value = $t_cookie_contents[1];
@@ -193,10 +194,20 @@ if( $t_filter_save ) {
 			$t_filter_project_value = ALL_PROJECTS;
 		}
 	}
 }
 
+if( !is_blank( $t_filter_config_value ) && (int)$t_filter_config_value !== META_FILTER_NONE ) {
+	// check that config value exists
+	if( @config_get_global( $t_filter_config_value ) === null ) {
+		$t_cookie_path = config_get( 'cookie_path' );
+		gpc_clear_cookie( $t_cookie_name, $t_cookie_path );
+
+		trigger_error( ERROR_GENERIC, ERROR );
+	}
+}
+
 # Get config edit values
 $t_edit_user_id         = gpc_get_int( 'user_id', $t_filter_user_value == META_FILTER_NONE ? ALL_USERS : $t_filter_user_value );
 $t_edit_project_id      = gpc_get_int( 'project_id', $t_filter_project_value == META_FILTER_NONE ? ALL_PROJECTS : $t_filter_project_value );
 $t_edit_option          = gpc_get_string( 'config_option', $t_filter_config_value == META_FILTER_NONE ? '' : $t_filter_config_value );
 $t_edit_type            = gpc_get_string( 'type', CONFIG_TYPE_DEFAULT );

Fixed code: 
if( !is_blank( $t_filter_config_value ) && (int)$t_filter_config_value !== META_FILTER_NONE ) {
	// check that config value exists
	if( @config_get_global( $t_filter_config_value ) === null ) {
		$t_cookie_path = config_get( 'cookie_path' );
		gpc_clear_cookie( $t_cookie_name, $t_cookie_path );

		trigger_error( ERROR_GENERIC, ERROR );
	}
}