Vulnerabilities

TI-2010-04381 CVE-2010-4658 · GHSA-cg4f-h5jv-phrq

statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.

LOW 26

statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00853 Published 2020-02-07 No fix listed CWE-74

TI-2010-04382 CVE-2010-4659 · GHSA-85v4-5c8r-m8g3

Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.

LOW 29

Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00921 Published 2019-11-20 No fix listed CWE-79

TI-2010-04383 CVE-2010-4660 · GHSA-57jg-m92r-vjm8

Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..

MEDIUM 45

Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01315 Published 2019-11-20 No fix listed CWE-20

TI-2011-02980 CVE-2011-3370 · GHSA-8jq6-hqmc-9q2h

statusnet before 0.9.9 has XSS

LOW 29

statusnet before 0.9.9 has XSS

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00986 Published 2019-11-12 No fix listed CWE-79

TI-2013-03614 CVE-2013-4137 · GHSA-wrr5-j73x-c8jq

Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow…

LOW 35

Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow remote attackers to execute arbitrary SQL commands via vectors related to user lists and "a particular tag format."

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0113 Published 2013-10-11 No fix listed CWE-89

TI-2011-03359 CVE-2011-3802 · GHSA-f6m2-8869-r853

StatusNet 0.9.6 allows remote attackers to obtain sensitive information via a direct…

LOW 25

StatusNet 0.9.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tpl/index.php and certain other fil…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01229 Published 2011-09-24 No fix listed CWE-200

Vulnerabilities

Filters

statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.

Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.

Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..

statusnet before 0.9.9 has XSS

Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow…

StatusNet 0.9.6 allows remote attackers to obtain sensitive information via a direct…