rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service (SEGV on unknown address with READ memory access in a tsk_getu16 call in hfs_dir_open_meta_cb in tsk/fs/hfs_dent.c).
Vulnerability ID: CVE-2018-19497
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/sleuthkit/sleuthkit
Published: 2018-11-29
File: tsk/fs/hfs.c
Commit message: Merge pull request #1374 from JordyZomer/develop

Fix CVE-2018-19497.
Commit author: Brian Carrier

Vulnerable version (before fix):
 hfs_cat_traverse(HFS_INFO * hfs,                 key = (hfs_btree_key_cat *) & node[rec_off];                  keylen = 2 + tsk_getu16(hfs->fs_info.endian, key->key_len);                 if ((keylen) > nodesize) {                     tsk_error_set_errno(TSK_ERR_FS_GENFS);                     tsk_error_set_errstr                         ("hfs_cat_traverse: length of key %d in index node %d too large (%d vs %"                         PRIu16 ")", rec, cur_node, keylen, nodesize);                     free(node);                     return 1;                 }

Fixed version (after fix):
 hfs_cat_traverse(HFS_INFO * hfs,                 key = (hfs_btree_key_cat *) & node[rec_off];                  keylen = 2 + tsk_getu16(hfs->fs_info.endian, key->key_len);                                 if (keylen >= nodesize - rec_off) {                     tsk_error_set_errno(TSK_ERR_FS_GENFS);                     tsk_error_set_errstr                         ("hfs_cat_traverse: length of key %d in index node %d too large (%d vs %"                         PRIu16 ")", rec, cur_node, keylen, (nodesize - rec_off));                     free(node);                     return 1;                 }

Patch:
patch: @@ -956,11 +956,12 @@ hfs_cat_traverse(HFS_INFO * hfs,
                 key = (hfs_btree_key_cat *) & node[rec_off];
 
                 keylen = 2 + tsk_getu16(hfs->fs_info.endian, key->key_len);
-                if ((keylen) > nodesize) {
+               
+                if (keylen >= nodesize - rec_off) {
                     tsk_error_set_errno(TSK_ERR_FS_GENFS);
                     tsk_error_set_errstr
                         ("hfs_cat_traverse: length of key %d in index node %d too large (%d vs %"
-                        PRIu16 ")", rec, cur_node, keylen, nodesize);
+                        PRIu16 ")", rec, cur_node, keylen, (nodesize - rec_off));
                     free(node);
                     return 1;
                 }
path: tsk/fs/hfs.c
Vulnerability: In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c.
Vulnerability ID: CVE-2018-19824
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2018-12-03
File: sound/usb/card.c
Commit message: ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c

If a USB sound card reports 0 interfaces, an error condition is triggered
and the function usb_audio_probe errors out. In the error path, there was a
use-after-free vulnerability where the memory object of the card was first
freed, followed by a decrement of the number of active chips. Moving the
decrement above the atomic_dec fixes the UAF.

[ The original problem was introduced in 3.1 kernel, while it was
  developed in a different form.  The Fixes tag below indicates the
  original commit but it doesn't mean that the patch is applicable
  cleanly. -- tiwai ]

Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit")
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Hui Peng

Vulnerable version (before fix):
 static int usb_audio_probe(struct usb_interface *intf,   __error: 	if (chip) { 		if (!chip->num_interfaces) 			snd_card_free(chip->card); 		atomic_dec(&chip->active); 	} 	mutex_unlock(&register_mutex); 	return err;

Fixed version (after fix):
 static int usb_audio_probe(struct usb_interface *intf,   __error: 	if (chip) { 		/* chip->active is inside the chip->card object, 		 * decrement before memory is possibly returned. 		 */ 		atomic_dec(&chip->active); 		if (!chip->num_interfaces) 			snd_card_free(chip->card); 	} 	mutex_unlock(&register_mutex); 	return err;

Patch:
patch: @@ -682,9 +682,12 @@ static int usb_audio_probe(struct usb_interface *intf,
 
  __error:
 	if (chip) {
+		/* chip->active is inside the chip->card object,
+		 * decrement before memory is possibly returned.
+		 */
+		atomic_dec(&chip->active);
 		if (!chip->num_interfaces)
 			snd_card_free(chip->card);
-		atomic_dec(&chip->active);
 	}
 	mutex_unlock(&register_mutex);
 	return err;
path: sound/usb/card.c
Vulnerability: In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, because of certain incorrect parsing of '%' as a modulo operator in parser.cpp.
Vulnerability ID: CVE-2018-19837
CWE: CWE-400
Severity score: 2.9
Project: https://github.com/sass/libsass
Published: 2018-12-04
File: src/parser.cpp
Commit message: Remove legacy workaround for parsing modulo operator

Fixes #2659
Commit author: xzyfer

Vulnerable version (before fix):
 namespace Sass {     if (lex< variable >())     { return SASS_MEMORY_NEW(Variable, pstate, Util::normalize_underscores(lexed)); }      // Special case handling for `%` proceeding an interpolant.     if (lex< sequence< exactly<'%'>, optional< percentage > > >())     { return SASS_MEMORY_NEW(String_Constant, pstate, lexed); }      css_error("Invalid CSS", " after ", ": expected expression (e.g. 1px, bold), was ");      // unreachable statement

Fixed version (after fix):
 namespace Sass {     if (lex< variable >())     { return SASS_MEMORY_NEW(Variable, pstate, Util::normalize_underscores(lexed)); }      css_error("Invalid CSS", " after ", ": expected expression (e.g. 1px, bold), was ");      // unreachable statement

Patch:
patch: @@ -1723,10 +1723,6 @@ namespace Sass {
     if (lex< variable >())
     { return SASS_MEMORY_NEW(Variable, pstate, Util::normalize_underscores(lexed)); }
 
-    // Special case handling for `%` proceeding an interpolant.
-    if (lex< sequence< exactly<'%'>, optional< percentage > > >())
-    { return SASS_MEMORY_NEW(String_Constant, pstate, lexed); }
-
     css_error("Invalid CSS", " after ", ": expected expression (e.g. 1px, bold), was ");
 
     // unreachable statement
path: src/parser.cpp
Vulnerability: The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.
Vulnerability ID: CVE-2018-19841
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/dbry/WavPack
Published: 2018-12-04
File: src/open_utils.c
Commit message: issue #54: fix potential out-of-bounds heap read
Commit author: David Bryant

Vulnerable version (before fix):
 int WavpackVerifySingleBlock (unsigned char *buffer, int verify_checksum) #endif              if (meta_bc == 4) {                 if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff) || *dp++ != ((csum >> 16) & 0xff) || *dp++ != ((csum >> 24) & 0xff))                     return FALSE;             }             else {                 csum ^= csum >> 16;                  if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff))                     return FALSE;             } 

Fixed version (after fix):
 int WavpackVerifySingleBlock (unsigned char *buffer, int verify_checksum) #endif              if (meta_bc == 4) {                 if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff) || dp[2] != ((csum >> 16) & 0xff) || dp[3] != ((csum >> 24) & 0xff))                     return FALSE;             }             else {                 csum ^= csum >> 16;                  if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff))                     return FALSE;             } 

Patch:
patch: @@ -1258,13 +1258,13 @@ int WavpackVerifySingleBlock (unsigned char *buffer, int verify_checksum)
 #endif
 
             if (meta_bc == 4) {
-                if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff) || *dp++ != ((csum >> 16) & 0xff) || *dp++ != ((csum >> 24) & 0xff))
+                if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff) || dp[2] != ((csum >> 16) & 0xff) || dp[3] != ((csum >> 24) & 0xff))
                     return FALSE;
             }
             else {
                 csum ^= csum >> 16;
 
-                if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff))
+                if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff))
                     return FALSE;
             }
path: src/open_utils.c
Vulnerability: getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.
Vulnerability ID: CVE-2018-19842
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-12-04
File: libr/asm/p/asm_x86_nz.c
Commit message: Fix #12239 - crash in the x86.nz assembler ##asm (#12252)
Commit author: radare

Vulnerable version (before fix):
 LookupTable oplookup[] = { };  static x86newTokenType getToken(const char *str, size_t *begin, size_t *end) { 	// Skip whitespace 	while (begin && isspace ((ut8)str[*begin])) { 		++(*begin); 	}  	if (!str[*begin]) {                // null byte 		*end = *begin; 		return TT_EOF; 	} else if (isalpha ((ut8)str[*begin])) {   // word token 		*end = *begin; 		while (end && isalnum ((ut8)str[*end])) { 			++(*end); 		} 		return TT_WORD; 	} else if (isdigit ((ut8)str[*begin])) {   // number token 		*end = *begin; 		while (end && isalnum ((ut8)str[*end])) {     // accept alphanumeric characters, because hex. 			++(*end);

Fixed version (after fix):
 LookupTable oplookup[] = { };  static x86newTokenType getToken(const char *str, size_t *begin, size_t *end) { 	if (*begin > strlen (str)) { 		return TT_EOF; 	} 	// Skip whitespace 	while (begin && str[*begin] && isspace ((ut8)str[*begin])) { 		++(*begin); 	}  	if (!str[*begin]) {                // null byte 		*end = *begin; 		return TT_EOF; 	} 	if (isalpha ((ut8)str[*begin])) {   // word token 		*end = *begin; 		while (end && str[*end] && isalnum ((ut8)str[*end])) { 			++(*end); 		} 		return TT_WORD; 	} 	if (isdigit ((ut8)str[*begin])) {   // number token 		*end = *begin; 		while (end && isalnum ((ut8)str[*end])) {     // accept alphanumeric characters, because hex. 			++(*end);

Patch:
patch: @@ -4295,21 +4295,26 @@ LookupTable oplookup[] = {
 };
 
 static x86newTokenType getToken(const char *str, size_t *begin, size_t *end) {
+	if (*begin > strlen (str)) {
+		return TT_EOF;
+	}
 	// Skip whitespace
-	while (begin && isspace ((ut8)str[*begin])) {
+	while (begin && str[*begin] && isspace ((ut8)str[*begin])) {
 		++(*begin);
 	}
 
 	if (!str[*begin]) {                // null byte
 		*end = *begin;
 		return TT_EOF;
-	} else if (isalpha ((ut8)str[*begin])) {   // word token
+	}
+	if (isalpha ((ut8)str[*begin])) {   // word token
 		*end = *begin;
-		while (end && isalnum ((ut8)str[*end])) {
+		while (end && str[*end] && isalnum ((ut8)str[*end])) {
 			++(*end);
 		}
 		return TT_WORD;
-	} else if (isdigit ((ut8)str[*begin])) {   // number token
+	}
+	if (isdigit ((ut8)str[*begin])) {   // number token
 		*end = *begin;
 		while (end && isalnum ((ut8)str[*end])) {     // accept alphanumeric characters, because hex.
 			++(*end);
path: libr/asm/p/asm_x86_nz.c
Vulnerability: opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.
Vulnerability ID: CVE-2018-19843
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-12-04
File: libr/asm/p/asm_x86_nz.c
Commit message: Fix #12242 - Crash in x86.nz assembler (#12266)
Commit author: radare

Vulnerable version (before fix):
 static int opmov(RAsm *a, ut8 *data, const Opcode *op) { 			if (op->operands[1].scale[0] == 0) { 				return -1; 			} 			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0]]; 			data[l++] = 0x8b; 			data[l++] = op->operands[0].reg << 3 | 0x5; 			data[l++] = offset; 			data[l++] = offset >> 8; 			data[l++] = offset >> 16;

Fixed version (after fix):
 static int opmov(RAsm *a, ut8 *data, const Opcode *op) { 			if (op->operands[1].scale[0] == 0) { 				return -1; 			} 			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0] % 6]; 			data[l++] = 0x8b; 			data[l++] = (((ut32)op->operands[0].reg) << 3) | 0x5; 			data[l++] = offset; 			data[l++] = offset >> 8; 			data[l++] = offset >> 16;

Patch:
patch: @@ -2023,9 +2023,9 @@ static int opmov(RAsm *a, ut8 *data, const Opcode *op) {
 			if (op->operands[1].scale[0] == 0) {
 				return -1;
 			}
-			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0]];
+			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0] % 6];
 			data[l++] = 0x8b;
-			data[l++] = op->operands[0].reg << 3 | 0x5;
+			data[l++] = (((ut32)op->operands[0].reg) << 3) | 0x5;
 			data[l++] = offset;
 			data[l++] = offset >> 8;
 			data[l++] = offset >> 16;
path: libr/asm/p/asm_x86_nz.c
Vulnerability: FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later.
Vulnerability ID: CVE-2018-1999011
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2018-07-23
File: libavformat/asfdec_o.c
Commit message: avformat/asfdec_o: Check size_bmp more fully

Fixes: integer overflow and out of array access
Fixes: asfo-crash-46080c4341572a7137a162331af77f6ded45cbd7

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int parse_video_info(AVIOContext *pb, AVStream *st)     st->codecpar->codec_id  = ff_codec_get_id(ff_codec_bmp_tags, tag);     size_bmp = FFMAX(size_asf, size_bmp);      if (size_bmp > BMP_HEADER_SIZE) {         int ret;         st->codecpar->extradata_size  = size_bmp - BMP_HEADER_SIZE;         if (!(st->codecpar->extradata = av_malloc(st->codecpar->extradata_size +

Fixed version (after fix):
 static int parse_video_info(AVIOContext *pb, AVStream *st)     st->codecpar->codec_id  = ff_codec_get_id(ff_codec_bmp_tags, tag);     size_bmp = FFMAX(size_asf, size_bmp);      if (size_bmp > BMP_HEADER_SIZE &&         size_bmp < INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {         int ret;         st->codecpar->extradata_size  = size_bmp - BMP_HEADER_SIZE;         if (!(st->codecpar->extradata = av_malloc(st->codecpar->extradata_size +

Patch:
patch: @@ -706,7 +706,8 @@ static int parse_video_info(AVIOContext *pb, AVStream *st)
     st->codecpar->codec_id  = ff_codec_get_id(ff_codec_bmp_tags, tag);
     size_bmp = FFMAX(size_asf, size_bmp);
 
-    if (size_bmp > BMP_HEADER_SIZE) {
+    if (size_bmp > BMP_HEADER_SIZE &&
+        size_bmp < INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) {
         int ret;
         st->codecpar->extradata_size  = size_bmp - BMP_HEADER_SIZE;
         if (!(st->codecpar->extradata = av_malloc(st->codecpar->extradata_size +
path: libavformat/asfdec_o.c
Vulnerability: FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.
Vulnerability ID: CVE-2018-1999013
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2018-07-23
File: libavformat/rmdec.c
Commit message: avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()

Fixes: use after free()
Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int rm_read_multi(AVFormatContext *s, AVIOContext *pb,          size2 = avio_rb32(pb);         ret = ff_rm_read_mdpr_codecdata(s, s->pb, st2, st2->priv_data,                                         size2, mime);         if (ret < 0)             return ret;     }

Fixed version (after fix):
 static int rm_read_multi(AVFormatContext *s, AVIOContext *pb,          size2 = avio_rb32(pb);         ret = ff_rm_read_mdpr_codecdata(s, s->pb, st2, st2->priv_data,                                         size2, NULL);         if (ret < 0)             return ret;     }

Patch:
patch: @@ -522,7 +522,7 @@ static int rm_read_multi(AVFormatContext *s, AVIOContext *pb,
 
         size2 = avio_rb32(pb);
         ret = ff_rm_read_mdpr_codecdata(s, s->pb, st2, st2->priv_data,
-                                        size2, mime);
+                                        size2, NULL);
         if (ret < 0)
             return ret;
     }
path: libavformat/rmdec.c
Vulnerability: FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.
Vulnerability ID: CVE-2018-1999014
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2018-07-23
File: libavformat/mxfdec.c
Commit message: avformat/mxfdec: Fix av_log context

Fixes: out of array access
Fixes: mxf-crash-1c2e59bf07a34675bfb3ada5e1ec22fa9f38f923

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int mxf_parse_structural_metadata(MXFContext *mxf)                 MXFEssenceContainerData *essence_data;                  if (!(essence_data = mxf_resolve_strong_ref(mxf, &mxf->essence_container_data_refs[k], EssenceContainerData))) {                     av_log(mxf, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");                     continue;                 }                 if (!memcmp(component->source_package_ul, essence_data->package_ul, sizeof(UID)) && !memcmp(component->source_package_uid, essence_data->package_uid, sizeof(UID))) {

Fixed version (after fix):
 static int mxf_parse_structural_metadata(MXFContext *mxf)                 MXFEssenceContainerData *essence_data;                  if (!(essence_data = mxf_resolve_strong_ref(mxf, &mxf->essence_container_data_refs[k], EssenceContainerData))) {                     av_log(mxf->fc, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");                     continue;                 }                 if (!memcmp(component->source_package_ul, essence_data->package_ul, sizeof(UID)) && !memcmp(component->source_package_uid, essence_data->package_uid, sizeof(UID))) {

Patch:
patch: @@ -2155,7 +2155,7 @@ static int mxf_parse_structural_metadata(MXFContext *mxf)
                 MXFEssenceContainerData *essence_data;
 
                 if (!(essence_data = mxf_resolve_strong_ref(mxf, &mxf->essence_container_data_refs[k], EssenceContainerData))) {
-                    av_log(mxf, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");
+                    av_log(mxf->fc, AV_LOG_TRACE, "could not resolve essence container data strong ref\n");
                     continue;
                 }
                 if (!memcmp(component->source_package_ul, essence_data->package_ul, sizeof(UID)) && !memcmp(component->source_package_uid, essence_data->package_uid, sizeof(UID))) {
path: libavformat/mxfdec.c
Vulnerability: Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
Vulnerability ID: CVE-2018-20328
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/chamilo/chamilo-lms
Published: 2018-12-21
File: main/social/group_view.php
Commit message: Remove XSS from social groups page - refs #2746
Commit author: Yannick Warnier

Vulnerable version (before fix):
 function add_image_form() {  if ($group_id != 0) {     $group_info = $usergroup->get($group_id);      $interbreadcrumb[] = ['url' => '#', 'name' => $group_info['name']];  function add_image_form() { $socialForum = '';  $group_info = $usergroup->get($group_id);  //Loading group information if (isset($_GET['status']) && $_GET['status'] == 'sent') {

Fixed version (after fix):
 function add_image_form() {  if ($group_id != 0) {     $group_info = $usergroup->get($group_id);     $group_info['name'] = Security::remove_XSS($group_info['name']);     $group_info['description'] = Security::remove_XSS($group_info['description']);      $interbreadcrumb[] = ['url' => '#', 'name' => $group_info['name']];  function add_image_form() { $socialForum = '';  $group_info = $usergroup->get($group_id); $group_info['name'] = Security::remove_XSS($group_info['name']); $group_info['description'] = Security::remove_XSS($group_info['description']);  //Loading group information if (isset($_GET['status']) && $_GET['status'] == 'sent') {

Patch:
patch: @@ -110,6 +110,8 @@ function add_image_form() {
 
 if ($group_id != 0) {
     $group_info = $usergroup->get($group_id);
+    $group_info['name'] = Security::remove_XSS($group_info['name']);
+    $group_info['description'] = Security::remove_XSS($group_info['description']);
 
     $interbreadcrumb[] = ['url' => '#', 'name' => $group_info['name']];
 
@@ -154,6 +156,8 @@ function add_image_form() {
 $socialForum = '';
 
 $group_info = $usergroup->get($group_id);
+$group_info['name'] = Security::remove_XSS($group_info['name']);
+$group_info['description'] = Security::remove_XSS($group_info['description']);
 
 //Loading group information
 if (isset($_GET['status']) && $_GET['status'] == 'sent') {
path: main/social/group_view.php