rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.
Vulnerability ID: CVE-2019-1010062
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/pluck-cms/pluck
Published: 2019-07-16
File: data/inc/images.php
Commit message: Fix issue #44. Thanks to Klaus.
Commit author: Bas S

Vulnerable version (before fix):
 if (isset($_POST['submit'])) { 	//Check if the file is JPG, PNG or GIF. 	if (in_array($_FILES['imagefile']['type'], array('image/pjpeg', 'image/jpeg','image/png', 'image/gif'))) { 		if (!copy($_FILES['imagefile']['tmp_name'], 'images/'.$_FILES['imagefile']['name'])) 			show_error($lang['general']['upload_failed'], 1);  		else { 			chmod('images/'.$_FILES['imagefile']['name'], 0666); 			?>

Fixed version (after fix):
 if (isset($_POST['submit'])) { 	//Check if the file is JPG, PNG or GIF. 	if (in_array($_FILES['imagefile']['type'], array('image/pjpeg', 'image/jpeg','image/png', 'image/gif'))) { 		/* fix issue 44. Thanks to Klaus.  */         $imagewhitelist = array('jfif', '.png', '.jpg', '.gif', 'jpeg');           if (!in_array(strtolower(substr($_FILES['imagefile']['name'], -4)), $imagewhitelist)) 			show_error($lang['general']['upload_failed'], 1); 		/* end of fix issue 44. Thanks to Klaus.  */ 		if (!copy($_FILES['imagefile']['tmp_name'], 'images/'.$_FILES['imagefile']['name'])) 			show_error($lang['general']['upload_failed'], 1); 		else { 			chmod('images/'.$_FILES['imagefile']['name'], 0666); 			?>

Patch:
patch: @@ -34,9 +34,13 @@
 if (isset($_POST['submit'])) {
 	//Check if the file is JPG, PNG or GIF.
 	if (in_array($_FILES['imagefile']['type'], array('image/pjpeg', 'image/jpeg','image/png', 'image/gif'))) {
+		/* fix issue 44. Thanks to Klaus.  */
+        $imagewhitelist = array('jfif', '.png', '.jpg', '.gif', 'jpeg');  
+        if (!in_array(strtolower(substr($_FILES['imagefile']['name'], -4)), $imagewhitelist))
+			show_error($lang['general']['upload_failed'], 1);
+		/* end of fix issue 44. Thanks to Klaus.  */
 		if (!copy($_FILES['imagefile']['tmp_name'], 'images/'.$_FILES['imagefile']['name']))
 			show_error($lang['general']['upload_failed'], 1);
-
 		else {
 			chmod('images/'.$_FILES['imagefile']['name'], 0666);
 			?>
path: data/inc/images.php
Vulnerability: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. The impact is: Potentially leaking code and/or data from previous Trusted Application. The component is: optee_os. The fixed version is: 3.4.0 and later.
Vulnerability ID: CVE-2019-1010294
CWE: CWE-189
Severity score: 2.9
Project: https://github.com/OP-TEE/optee_os
Published: 2019-07-15
File: core/arch/arm/kernel/user_ta.c
Commit message: core: clear the entire TA area

Previously we cleared (memset to zero) the size corresponding to code
and data segments, however the allocation for the TA is made on the
granularity of the memory pool, meaning that we did not clear all memory
and because of that we could potentially leak code and data of a
previous loaded TA.

Fixes: OP-TEE-2018-0006: "Potential disclosure of previously loaded TA
code and data"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Suggested-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Commit author: Joakim Bech

Vulnerable version (before fix):
 static struct mobj *alloc_ta_mem(size_t size) #else 	struct mobj *mobj = mobj_mm_alloc(mobj_sec_ddr, size, &tee_mm_sec_ddr);  	if (mobj) 		memset(mobj_get_va(mobj, 0), 0, size); 	return mobj; #endif }

Fixed version (after fix):
 static struct mobj *alloc_ta_mem(size_t size) #else 	struct mobj *mobj = mobj_mm_alloc(mobj_sec_ddr, size, &tee_mm_sec_ddr);  	if (mobj) { 		size_t granularity = BIT(tee_mm_sec_ddr.shift);  		/* Round up to allocation granularity size */ 		memset(mobj_get_va(mobj, 0), 0, ROUNDUP(size, granularity)); 	} 	return mobj; #endif }

Patch:
patch: @@ -197,8 +197,12 @@ static struct mobj *alloc_ta_mem(size_t size)
 #else
 	struct mobj *mobj = mobj_mm_alloc(mobj_sec_ddr, size, &tee_mm_sec_ddr);
 
-	if (mobj)
-		memset(mobj_get_va(mobj, 0), 0, size);
+	if (mobj) {
+		size_t granularity = BIT(tee_mm_sec_ddr.shift);
+
+		/* Round up to allocation granularity size */
+		memset(mobj_get_va(mobj, 0), 0, ROUNDUP(size, granularity));
+	}
 	return mobj;
 #endif
 }
path: core/arch/arm/kernel/user_ta.c
Vulnerability: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
Vulnerability ID: CVE-2019-1010296
CWE: CWE-787
Severity score: 10
Project: https://github.com/OP-TEE/optee_os
Published: 2019-07-15
File: core/tee/tee_svc_cryp.c
Commit message: svc: check for allocation overflow in syscall_cryp_obj_populate

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0009: "Integer overflow in crypto system calls"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Commit author: Joakim Bech

Vulnerable version (before fix):
  */  #include <assert.h> #include <crypto/crypto.h> #include <kernel/tee_ta_manager.h> #include <mm/tee_mmu.h> TEE_Result syscall_cryp_obj_populate(unsigned long obj, 	if (!type_props) 		return TEE_ERROR_NOT_IMPLEMENTED;  	attrs = malloc(sizeof(TEE_Attribute) * attr_count); 	if (!attrs) 		return TEE_ERROR_OUT_OF_MEMORY; 	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_attrs, attr_count, 			    attrs); 	if (res != TEE_SUCCESS)

Fixed version (after fix):
  */  #include <assert.h> #include <compiler.h> #include <crypto/crypto.h> #include <kernel/tee_ta_manager.h> #include <mm/tee_mmu.h> TEE_Result syscall_cryp_obj_populate(unsigned long obj, 	if (!type_props) 		return TEE_ERROR_NOT_IMPLEMENTED;  	size_t alloc_size = 0;  	if (MUL_OVERFLOW(sizeof(TEE_Attribute), attr_count, &alloc_size)) 		return TEE_ERROR_OVERFLOW;  	attrs = malloc(alloc_size); 	if (!attrs) 		return TEE_ERROR_OUT_OF_MEMORY;  	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_attrs, attr_count, 			    attrs); 	if (res != TEE_SUCCESS)

Patch:
patch: @@ -4,6 +4,7 @@
  */
 
 #include <assert.h>
+#include <compiler.h>
 #include <crypto/crypto.h>
 #include <kernel/tee_ta_manager.h>
 #include <mm/tee_mmu.h>
@@ -1547,9 +1548,15 @@ TEE_Result syscall_cryp_obj_populate(unsigned long obj,
 	if (!type_props)
 		return TEE_ERROR_NOT_IMPLEMENTED;
 
-	attrs = malloc(sizeof(TEE_Attribute) * attr_count);
+	size_t alloc_size = 0;
+
+	if (MUL_OVERFLOW(sizeof(TEE_Attribute), attr_count, &alloc_size))
+		return TEE_ERROR_OVERFLOW;
+
+	attrs = malloc(alloc_size);
 	if (!attrs)
 		return TEE_ERROR_OUT_OF_MEMORY;
+
 	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_attrs, attr_count,
 			    attrs);
 	if (res != TEE_SUCCESS)
path: core/tee/tee_svc_cryp.c
Vulnerability: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
Vulnerability ID: CVE-2019-1010296
CWE: CWE-190
Severity score: 10
Project: https://github.com/OP-TEE/optee_os
Published: 2019-07-15
File: core/tee/tee_svc_cryp.c
Commit message: svc: check for allocation overflow in syscall_cryp_obj_populate

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0009: "Integer overflow in crypto system calls"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Commit author: Joakim Bech

Vulnerable version (before fix):
  */  #include <assert.h> #include <crypto/crypto.h> #include <kernel/tee_ta_manager.h> #include <mm/tee_mmu.h> TEE_Result syscall_cryp_obj_populate(unsigned long obj, 	if (!type_props) 		return TEE_ERROR_NOT_IMPLEMENTED;  	attrs = malloc(sizeof(TEE_Attribute) * attr_count); 	if (!attrs) 		return TEE_ERROR_OUT_OF_MEMORY; 	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_attrs, attr_count, 			    attrs); 	if (res != TEE_SUCCESS)

Fixed version (after fix):
  */  #include <assert.h> #include <compiler.h> #include <crypto/crypto.h> #include <kernel/tee_ta_manager.h> #include <mm/tee_mmu.h> TEE_Result syscall_cryp_obj_populate(unsigned long obj, 	if (!type_props) 		return TEE_ERROR_NOT_IMPLEMENTED;  	size_t alloc_size = 0;  	if (MUL_OVERFLOW(sizeof(TEE_Attribute), attr_count, &alloc_size)) 		return TEE_ERROR_OVERFLOW;  	attrs = malloc(alloc_size); 	if (!attrs) 		return TEE_ERROR_OUT_OF_MEMORY;  	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_attrs, attr_count, 			    attrs); 	if (res != TEE_SUCCESS)

Patch:
patch: @@ -4,6 +4,7 @@
  */
 
 #include <assert.h>
+#include <compiler.h>
 #include <crypto/crypto.h>
 #include <kernel/tee_ta_manager.h>
 #include <mm/tee_mmu.h>
@@ -1547,9 +1548,15 @@ TEE_Result syscall_cryp_obj_populate(unsigned long obj,
 	if (!type_props)
 		return TEE_ERROR_NOT_IMPLEMENTED;
 
-	attrs = malloc(sizeof(TEE_Attribute) * attr_count);
+	size_t alloc_size = 0;
+
+	if (MUL_OVERFLOW(sizeof(TEE_Attribute), attr_count, &alloc_size))
+		return TEE_ERROR_OVERFLOW;
+
+	attrs = malloc(alloc_size);
 	if (!attrs)
 		return TEE_ERROR_OUT_OF_MEMORY;
+
 	res = copy_in_attrs(to_user_ta_ctx(sess->ctx), usr_attrs, attr_count,
 			    attrs);
 	if (res != TEE_SUCCESS)
path: core/tee/tee_svc_cryp.c
Vulnerability: Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.
Vulnerability ID: CVE-2019-10232
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/glpi-project/glpi
Published: 2019-03-27
File: scripts/unlock_tasks.php
Commit message: Cast value to integer
Commit author: Johan Cwiklinski

Vulnerable version (before fix):
    } } if (isset($_GET['cycle'])) {    $cycle = $_GET['cycle']; } else {    $cycle = 25; }       Event::log($task['id'], 'Crontask', 5, 'Configuration', $message);    } } echo "Number of unlocked tasks : ".$unlocked_tasks."\n";\ No newline at end of file

Fixed version (after fix):
    } } if (isset($_GET['cycle'])) {    $cycle = (int)$_GET['cycle']; } else {    $cycle = 25; }       Event::log($task['id'], 'Crontask', 5, 'Configuration', $message);    } }\ No newline at end of file echo "Number of unlocked tasks : ".$unlocked_tasks."\n";

Patch:
patch: @@ -46,7 +46,7 @@
    }
 }
 if (isset($_GET['cycle'])) {
-   $cycle = $_GET['cycle'];
+   $cycle = (int)$_GET['cycle'];
 } else {
    $cycle = 25;
 }
@@ -84,4 +84,4 @@
       Event::log($task['id'], 'Crontask', 5, 'Configuration', $message);
    }
 }
-echo "Number of unlocked tasks : ".$unlocked_tasks."\n";
\ No newline at end of file
+echo "Number of unlocked tasks : ".$unlocked_tasks."\n";
path: scripts/unlock_tasks.php
Vulnerability: Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
Vulnerability ID: CVE-2019-10664
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/domoticz/domoticz
Published: 2019-03-31
File: main/WebServer.cpp
Commit message: Fixed possible SQL Injection Vulnerability (Thanks to Fabio Carretto!)
Commit author: Rob Peters

Vulnerable version (before fix):
 namespace http { 				return; 			} 			std::vector<std::vector<std::string> > result; 			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%s", idx.c_str()); 			if (result.empty()) 				return; 			reply::set_content(&rep, result[0][0].begin(), result[0][0].end());

Fixed version (after fix):
 namespace http { 				return; 			} 			std::vector<std::vector<std::string> > result; 			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%d", atol(idx.c_str())); 			if (result.empty()) 				return; 			reply::set_content(&rep, result[0][0].begin(), result[0][0].end());

Patch:
patch: @@ -10772,7 +10772,7 @@ namespace http {
 				return;
 			}
 			std::vector<std::vector<std::string> > result;
-			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%s", idx.c_str());
+			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%d", atol(idx.c_str()));
 			if (result.empty())
 				return;
 			reply::set_content(&rep, result[0][0].begin(), result[0][0].end());
path: main/WebServer.cpp
Vulnerability: The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
Vulnerability ID: CVE-2019-10864
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/wp-statistics/wp-statistics
Published: 2019-04-23
File: includes/functions/functions.php
Commit message: fix xss Attach Get Title Of Page
Commit author: Mehrshad Darzi

Vulnerable version (before fix):
 function wp_statistics_get_site_title( $url ) { 		if ( isset( $dom ) and $dom->getElementsByTagName( 'title' )->length > 0 ) { 			$title = $dom->getElementsByTagName( 'title' )->item( '0' )->nodeValue; 		} 		return ( wp_strip_all_tags( $title ) == "" ? false : $title ); 	}  	return false;

Fixed version (after fix):
 function wp_statistics_get_site_title( $url ) { 		if ( isset( $dom ) and $dom->getElementsByTagName( 'title' )->length > 0 ) { 			$title = $dom->getElementsByTagName( 'title' )->item( '0' )->nodeValue; 		} 		return ( wp_strip_all_tags( $title ) == "" ? false : wp_strip_all_tags( $title ) ); 	}  	return false;

Patch:
patch: @@ -2094,7 +2094,7 @@ function wp_statistics_get_site_title( $url ) {
 		if ( isset( $dom ) and $dom->getElementsByTagName( 'title' )->length > 0 ) {
 			$title = $dom->getElementsByTagName( 'title' )->item( '0' )->nodeValue;
 		}
-		return ( wp_strip_all_tags( $title ) == "" ? false : $title );
+		return ( wp_strip_all_tags( $title ) == "" ? false : wp_strip_all_tags( $title ) );
 	}
 
 	return false;
path: includes/functions/functions.php
Vulnerability: Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.
Vulnerability ID: CVE-2019-10874
CWE: CWE-352
Severity score: 6.4
Project: https://github.com/bolt/bolt
Published: 2019-04-05
File: src/Config.php
Commit message: Blacklist some common PHP file extensions
Commit author: Bob den Otter

Vulnerable version (before fix):
 protected function parseGeneral()                 // as a regex-like string, and we switched to an array. If we find the old style, fall back to the defaults.                 unset($general['accept_file_types']);             }             // accept uppercase and lowercase file extensions.             $general['accept_file_types'] = array_values(                 array_unique(

Fixed version (after fix):
 protected function parseGeneral()                 // as a regex-like string, and we switched to an array. If we find the old style, fall back to the defaults.                 unset($general['accept_file_types']);             }              // Just.. Say no to these.             $general['accept_file_types'] = array_diff($general['accept_file_types'], ['sh', 'asp', 'cgi', 'php', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5' ,'phtm', 'phtml']);              // accept uppercase and lowercase file extensions.             $general['accept_file_types'] = array_values(                 array_unique(

Patch:
patch: @@ -308,6 +308,10 @@ protected function parseGeneral()
                 // as a regex-like string, and we switched to an array. If we find the old style, fall back to the defaults.
                 unset($general['accept_file_types']);
             }
+
+            // Just.. Say no to these.
+            $general['accept_file_types'] = array_diff($general['accept_file_types'], ['sh', 'asp', 'cgi', 'php', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5' ,'phtm', 'phtml']);
+
             // accept uppercase and lowercase file extensions.
             $general['accept_file_types'] = array_values(
                 array_unique(
path: src/Config.php
Vulnerability: gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file.
Vulnerability ID: CVE-2019-11222
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2019-04-15
File: src/utils/os_divers.c
Commit message: fix buffer overrun in gf_bin128_parse

closes #1204
closes #1205
Commit author: Aurelien David

Vulnerable version (before fix):
 GF_Err gf_bin128_parse(const char *string, bin128 value) 				break; 			sprintf(szV, "%c%c", string[j], string[j+1]); 			sscanf(szV, "%x", &v); 			value[i] = v; 			i++; 		} 	} 	if (i != 16) {

Fixed version (after fix):
 GF_Err gf_bin128_parse(const char *string, bin128 value) 				break; 			sprintf(szV, "%c%c", string[j], string[j+1]); 			sscanf(szV, "%x", &v); 			if (i > 15) { 				// force error check below 				i++; 				break; 			} 			value[i] = v; 			i++;  		} 	} 	if (i != 16) {

Patch:
patch: @@ -1988,8 +1988,14 @@ GF_Err gf_bin128_parse(const char *string, bin128 value)
 				break;
 			sprintf(szV, "%c%c", string[j], string[j+1]);
 			sscanf(szV, "%x", &v);
+			if (i > 15) {
+				// force error check below
+				i++;
+				break;
+			}
 			value[i] = v;
 			i++;
+
 		}
 	}
 	if (i != 16) {
path: src/utils/os_divers.c
Vulnerability: app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated administrative attackers to obtain credentials and other sensitive information.
Vulnerability ID: CVE-2019-11407
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-06-17
File: app/operator_panel/index_inc.php
Commit message: Update index_inc.php
Commit author: FusionPBX

Vulnerable version (before fix):
 } echo "<br><br>";  if (if_group("superadmin") && isset($_GET['debug'])) { 	echo '$activity<br>'; 	echo "<textarea style='width: 100%; height: 600px; overflow: scroll;' onfocus='refresh_stop();' onblur='refresh_start();'>"; 	print_r($_SESSION); 	echo "</textarea>"; }  ?>

Fixed version (after fix):
 } echo "<br><br>";  /* if (if_group("superadmin") && isset($_GET['debug'])) { 	echo '$activity<br>'; 	echo "<textarea style='width: 100%; height: 600px; overflow: scroll;' onfocus='refresh_stop();' onblur='refresh_start();'>"; 	print_r($_SESSION); 	echo "</textarea>"; } */  ?>

Patch:
patch: @@ -449,6 +449,7 @@
 }
 echo "<br><br>";
 
+/*
 if (if_group("superadmin") && isset($_GET['debug'])) {
 	echo '$activity<br>';
 	echo "<textarea style='width: 100%; height: 600px; overflow: scroll;' onfocus='refresh_stop();' onblur='refresh_start();'>";
@@ -461,5 +462,6 @@
 	print_r($_SESSION);
 	echo "</textarea>";
 }
+*/
 
 ?>
path: app/operator_panel/index_inc.php
Vulnerability: XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placing a phone call using a specially crafted caller ID number. This can further lead to remote code execution by chaining this vulnerability with a command injection vulnerability also present in FusionPBX.
Vulnerability ID: CVE-2019-11408
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-06-17
File: app/operator_panel/index_inc.php
Commit message: Update index_inc.php
Commit author: FusionPBX

Vulnerable version (before fix):
 		} 		$block .= "			</td></tr></table>"; 		if (permission_exists('operator_panel_call_details')) { 			$block .= "			<span id='op_caller_details_".$extension."'><strong>".$call_name."</strong><br>".$call_number."</span>"; 		} 		$block .= "		</span>"; 		//transfer

Fixed version (after fix):
 		} 		$block .= "			</td></tr></table>"; 		if (permission_exists('operator_panel_call_details')) { 			$block .= "			<span id='op_caller_details_".$extension."'><strong>".escape($call_name)."</strong><br>".escape($call_number)."</span>"; 		} 		$block .= "		</span>"; 		//transfer

Patch:
patch: @@ -367,7 +367,7 @@
 		}
 		$block .= "			</td></tr></table>";
 		if (permission_exists('operator_panel_call_details')) {
-			$block .= "			<span id='op_caller_details_".$extension."'><strong>".$call_name."</strong><br>".$call_number."</span>";
+			$block .= "			<span id='op_caller_details_".$extension."'><strong>".escape($call_name)."</strong><br>".escape($call_number)."</span>";
 		}
 		$block .= "		</span>";
 		//transfer
path: app/operator_panel/index_inc.php