hitoshura25/cvefixes huggingface dataset:
CVE-2012-4393 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) addBookmark.php, (2) delBookmark.php, or (3) editBookmark.php in bookmarks/ajax/; (4) calendar/delete.php, (5) calendar/edit.php, (6) calendar/new.php, (7) calendar/update.php, (8) event/delete.php, (9) event/edit.php, (10) event/move.php, (11) event/new.php, (12) import/import.php, (13) settings/setfirstday.php, (14) settings/settimeformat.php, (15) share/changepermission.php, (16) share/share.php, (17) or share/unshare.php in calendar/ajax/; (18) external/ajax/setsites.php, (19) files/ajax/delete.php, (20) files/ajax/move.php, (21) files/ajax/newfile.php, (22) files/ajax/newfolder.php, (23) files/ajax/rename.php, (24) files_sharing/ajax/email.php, (25) files_sharing/ajax/setpermissions.php, (26) files_sharing/ajax/share.php, (27) files_sharing/ajax/toggleresharing.php, (28) files_sharing/ajax/togglesharewitheveryone.php, (29) files_sharing/ajax/unshare.php, (30) files_texteditor/ajax/savefile.php, (31) files_versions/ajax/rollbackVersion.php, (32) gallery/ajax/createAlbum.php, (33) gallery/ajax/sharing.php, (34) tasks/ajax/addtask.php, (35) tasks/ajax/addtaskform.php, (36) tasks/ajax/delete.php, or (37) tasks/ajax/edittask.php in apps/; or administrators for requests that use (38) changepassword.php, (39) creategroup.php, (40) createuser.php, (41) disableapp.php, (42) enableapp.php, (43) lostpassword.php, (44) removegroup.php, (45) removeuser.php, (46) setlanguage.php, (47) setloglevel.php, (48) setquota.php, or (49) togglegroups.php in settings/ajax/.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/owncloud/core
Files changed:
settings/ajax/changepassword.php
settings/ajax/creategroup.php
settings/ajax/createuser.php
settings/ajax/disableapp.php
settings/ajax/enableapp.php
settings/ajax/lostpassword.php
settings/ajax/removegroup.php
settings/ajax/removeuser.php
settings/ajax/setlanguage.php
settings/ajax/setloglevel.php
settings/ajax/setquota.php
settings/ajax/togglegroups.php
Commit message: CSRF checks


Vulnerable code:
if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){	$email=trim($_POST['email']);


Fixed code:
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){
	$email=trim($_POST['email']);
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
CVE-2012-4394 (JavaScript, published 2012-09-05T23:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/files/js/filelist.js
Commit message: Sanitizing file names


Vulnerable code:
		html+='<a class="name" href="download.php?file='+$('#dir').val()+'/'+name+'"><span class="nametext">'+basename

Fixed code:
		html+='<a class="name" href="download.php?file='+$('#dir').val().replace(/</, '&lt;').replace(/>/, '&gt;')+'/'+name+'"><span class="nametext">'+basename
CVE-2012-4395 (PHP, published 2012-09-05T23:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirect_url parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
index.php
Commit message: fixed xss vulnerability


Vulnerable code:
		$redirect_url = (isset($_REQUEST['redirect_url'])) ? $_REQUEST['redirect_url'] : $_SERVER['REQUEST_URI'];

Fixed code:
		$redirect_url = (isset($_REQUEST['redirect_url'])) ? strip_tags($_REQUEST['redirect_url']) : $_SERVER['REQUEST_URI'];
CVE-2012-4396 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/calendar/lib/object.php
Commit message: xss vulnerability fixed


Vulnerable code:
		$title = $request["title"];
		$location = $request["location"];
		$description = $request["description"];

Fixed code:
		$title = strip_tags($request["title"]);
		$location = strip_tags($request["location"]);
		$description = strip_tags($request["description"]);
CVE-2012-4396 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/media/lib_scanner.php
Commit message: xss vulnerability fixed


Vulnerable code:
			$artist=stripslashes($data['comments']['artist'][0]);
			$album=stripslashes($data['comments']['album'][0]);
			$title=stripslashes($data['comments']['title'][0]);

Fixed code:
			$artist=strip_tags(stripslashes($data['comments']['artist'][0]));
			$album=strip_tags(stripslashes($data['comments']['album'][0]));
			$title=strip_tags(stripslashes($data['comments']['title'][0]));
CVE-2012-4396 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/calendar/templates/part.choosecalendar.rowfields.php
Commit message: fix XSS in Calendar


Vulnerable code:
echo '<td width="20px"><a href="#" onclick="Calendar.UI.showCalDAVUrl(\'' . OCP\USER::getUser() . '\', \'' . $_['calendar']['uri'] . '\');" title="' . $l->t("CalDav Link") . '" class="action"><img  class="svg action" src="'.OCP\Util::imagePath('core', 'actions/public.svg').'"></a></td>';

Fixed code:
echo '<td width="20px"><a href="#" onclick="Calendar.UI.showCalDAVUrl(\'' . OCP\USER::getUser() . '\', \'' . htmlentities($_['calendar']['uri']) . '\');" title="' . $l->t("CalDav Link") . '" class="action"><img  class="svg action" src="'.OCP\Util::imagePath('core', 'actions/public.svg').'"></a></td>';
CVE-2012-4396 (JavaScript, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
core/js/multiselect.js
Commit message: fix potential xss in multiselect


Vulnerable code:
				var input=$('<input id="'+id+'" type="checkbox"/>');
				var label=$('<label for="'+id+'">'+item+'</label>');
							select.append($('<option selected="selected" value="'+$(this).val()+'">'+$(this).val()+'</option>'));

Fixed code:
				var input=$('<input type="checkbox"/>');
				input.attr('id',id);
				var label=$('<label/>');
				label.attr('for',id);
				label.text(item);
							var option=$('<option selected="selected"/>');
							option.attr('value',$(this).val());
							option.text($(this).val());
							select.append(optione);
CVE-2012-4396 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/calendar/templates/part.import.php
Commit message: fix another XSS


Vulnerable code:

Fixed code:
for($i = 0;$i<count($calendar_options);$i++){
	$calendar_options[$i]['displayname'] = htmlspecialchars($calendar_options[$i]['displayname']);
}
CVE-2012-4396 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/user_ldap/settings.php
Commit message: Sanitzing user input


Vulnerable code:
		$value = OCP\Config::getAppValue('user_ldap', $param,'');

Fixed code:
		$value = htmlentities(OCP\Config::getAppValue('user_ldap', $param,''));
CVE-2012-4396 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/gallery/lib/tiles.php
apps/gallery/templates/index.php
Commit message: Sanitizing user input


Vulnerable code:
		$r = '<div class="title gallery_div">'.$this->stack_name.'</div>';
		return 'javascript:openNewGal(\''.$this->stack_name.'\');';
var root = "<?php echo $root; ?>";

Fixed code:
		$r = '<div class="title gallery_div">'.htmlentities($this->stack_name).'</div>';
		return 'javascript:openNewGal(\''.htmlentities($this->stack_name).'\');';
var root = "<?php echo htmlentities($root); ?>";
CVE-2012-4396 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/bookmarks/addBm.php
apps/bookmarks/ajax/addBookmark.php
apps/bookmarks/ajax/delBookmark.php
apps/bookmarks/ajax/editBookmark.php
apps/bookmarks/ajax/recordClick.php
apps/bookmarks/ajax/updateList.php
apps/bookmarks/js/addBm.js
apps/bookmarks/js/bookmarks.js
apps/bookmarks/js/bookmarksearch.js
Commit message: Using POST instead of GET.


Vulnerable code:
addBookmark($_GET['url'], '', 'Read-Later');
$id = addBookmark($_GET['url'], $_GET['title'], $_GET['tags']);
$id = $_GET['id'];
$bookmark_id = (int)$_GET["id"];
	htmlspecialchars_decode($_GET["url"]),
	htmlspecialchars_decode($_GET["title"]),
$tags = explode(' ', urldecode($_GET["tags"]));
$params=array(OCP\USER::getUser(), htmlspecialchars_decode($_GET["url"]));
$filterTag = isset($_GET['tag']) ? htmlspecialchars_decode($_GET['tag']) : false;
$offset = isset($_GET['page']) ? intval($_GET['page']) * 10 : 0;
$sort = isset($_GET['sort']) ? ($_GET['sort']) : 'bookmarks_sorting_recent';

Fixed code:
addBookmark($_POST['url'], '', 'Read-Later');
$id = addBookmark($_POST['url'], $_POST['title'], $_POST['tags']);
$id = $_POST['id'];
$bookmark_id = (int)$_POST["id"];
	htmlspecialchars_decode($_POST["url"]),
	htmlspecialchars_decode($_POST["title"]),
$tags = explode(' ', urldecode($_POST["tags"]));
$params=array(OCP\USER::getUser(), htmlspecialchars_decode($_POST["url"]));
$filterTag = isset($_POST['tag']) ? htmlspecialchars_decode($_POST['tag']) : false;
$offset = isset($_POST['page']) ? intval($_POST['page']) * 10 : 0;
$sort = isset($_POST['sort']) ? ($_POST['sort']) : 'bookmarks_sorting_recent';
		type: 'POST',
		  type: 'POST',
			type: 'POST',
			type: 'POST',
		type: 'POST',
		type: 'POST',
		type: 'POST',
CVE-2012-4396 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/user_openid/settings.php
Commit message: Sanitize user input


Vulnerable code:
$tmpl->assign('identity',$identity);

Fixed code:
$tmpl->assign('identity',htmlentities($identity));
CVE-2012-4397 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to part.choosecalendar.rowfields.php or (2) part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or (3) unspecified vectors to apps/contacts/lib/vcard.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/calendar/templates/part.choosecalendar.rowfields.php
apps/calendar/templates/part.choosecalendar.rowfields.shared.php
Commit message: fix potential XSS


Vulnerable code:
echo '<td  id="' . OCP\USER::getUser() . '_' . $_['calendar']['id'] . '"><label for="active_' . $_['calendar']['id'] . '">' . $_['calendar']['displayname'] . '</label></td>';
echo '<td><label for="active_' . $_['share']['owner'] . '_' . $_['share']['calendar']['id'] . '">' . $_['share']['calendar']['displayname'] . '</label></td>';

Fixed code:
echo '<td  id="' . OCP\USER::getUser() . '_' . $_['calendar']['id'] . '"><label for="active_' . $_['calendar']['id'] . '">' . htmlspecialchars($_['calendar']['displayname']) . '</label></td>';
echo '<td><label for="active_' . $_['share']['owner'] . '_' . $_['share']['calendar']['id'] . '">' . htmlspecialchars($_['share']['calendar']['displayname']) . '</label></td>';
CVE-2012-4397 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to part.choosecalendar.rowfields.php or (2) part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or (3) unspecified vectors to apps/contacts/lib/vcard.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owncloud/core
Files changed:
apps/contacts/lib/vcard.php
Commit message: Contacts: Backport XSS fix.


Vulnerable code:

Fixed code:
			if(in_array($property->name, $stringprops)) {
				$property->value = strip_tags($property->value);
			}