Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: Ushahidi Component: Ushahidi Platform Clear all filters
TI-2012-03004 CVE-2012-3476 · GHSA-gxw6-rh79-pv7x

Multiple cross-site scripting (XSS) vulnerabilities in (1)…

Priority LOW 19

Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitra…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01093 Published 2012-08-12 No fix listed CWE-79
TI-2012-03002 CVE-2012-3474 · GHSA-hcf8-3vq6-r7jr

The comments API in application/libraries/api/MY_Comments_Api_Object.php in the Ushahidi…

Priority LOW 26

The comments API in application/libraries/api/MY_Comments_Api_Object.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attribu…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01816 Published 2012-08-12 No fix listed CWE-200
TI-2012-03000 CVE-2012-3472 · GHSA-mcf8-556r-mjwr

The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi…

Priority LOW 31

The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET reques…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.01315 Published 2012-08-12 No fix listed CWE-287
TI-2012-02999 CVE-2012-3471 · GHSA-g88j-r5hg-xh9v

Multiple SQL injection vulnerabilities in the edit functions in (1)…

Priority LOW 36

Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2) application/controllers/members/reports.php in the Ushahidi Platform before 2.5 allow remote attackers…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01758 Published 2012-08-12 No fix listed CWE-89
TI-2012-02998 CVE-2012-3470 · GHSA-r43c-fmg7-h9x5

Multiple SQL injection vulnerabilities in…

Priority LOW 35

Multiple SQL injection vulnerabilities in application/libraries/api/MY_Countries_Api_Object.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to _get_cou…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01213 Published 2012-08-12 No fix listed CWE-89