Vulnerabilities

TI-2021-02956 CVE-2021-4072 · GHSA-2xw8-j43j-5vxp

Cross-site Scripting (XSS) - Stored in elgg/elgg

LOW 26

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00721 Published 2021-12-24 Fixed in 3.3.24 CWE-79

TI-2021-02877 CVE-2021-3980 · GHSA-hx6g-q9v2-xh7v

Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg

LOW 36

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01598 Published 2021-12-03 Fixed in 3.3.23, 4.0.5 CWE-359

TI-2021-02861 CVE-2021-3964 · GHSA-gwpx-q2h9-wxgx

Authorization Bypass Through User-Controlled Key in elgg/elgg

LOW 28

elgg is vulnerable to Authorization Bypass Through User-Controlled Key

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00805 Published 2021-12-01 Fixed in 3.3.22 CWE-639

TI-2011-02588 CVE-2011-2936 · GHSA-33qp-rrww-3f5q

Elgg through 1.7.10 has a SQL injection vulnerability

MEDIUM 45

Elgg through 1.7.10 has a SQL injection vulnerability

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01546 Published 2019-11-12 No fix listed CWE-89

TI-2011-02587 CVE-2011-2935 · GHSA-mcfm-j5g6-w26f

Elgg through 1.7.10 has XSS

LOW 29

Elgg through 1.7.10 has XSS

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01057 Published 2019-11-12 Fixed in 1.7.11 CWE-79

TI-2019-08233 CVE-2019-11016 · GHSA-r6h7-846c-8m78

Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.

LOW 30

Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01188 Published 2019-04-08 Fixed in 1.12.18, 2.3.11 CWE-601

TI-2013-00168 CVE-2013-0234 · GHSA-p9w9-349j-r85v

Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and…

LOW 23

Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to ac…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01457 Published 2014-02-02 No fix listed CWE-79

TI-2012-05281 CVE-2012-6563 · GHSA-qq49-hmp5-gwv6

engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists…

LOW 23

engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01231 Published 2013-05-23 No fix listed CWE-264

TI-2012-05280 CVE-2012-6562 · GHSA-wx93-8gv6-wmq3

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the…

LOW 33

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01338 Published 2013-05-23 No fix listed CWE-264

TI-2012-05279 CVE-2012-6561 · GHSA-c3hw-j754-x5g9

Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5…

LOW 22

Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01187 Published 2013-05-23 No fix listed CWE-79

TI-2011-03290 CVE-2011-3733 · GHSA-mv23-rj4p-fj75

Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request…

LOW 26

Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by vendors/simpletest/test/visual_test.php…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01335 Published 2011-09-23 No fix listed CWE-200

Vulnerabilities

Filters