TI-2012-04722 CVE-2012-5618 · GHSA-3q7m-4q8x-8gvg
Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.
Priority MEDIUM 44
Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.
Vulnerabilities
11 records
TI-2013-01797 CVE-2013-2025 · GHSA-pfhf-8727-wwwh
Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows…
Priority LOW 24
Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
TI-2012-03004 CVE-2012-3476 · GHSA-gxw6-rh79-pv7x
Multiple cross-site scripting (XSS) vulnerabilities in (1)…
Priority LOW 19
Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitra…
TI-2012-03003 CVE-2012-3475 · GHSA-gqqq-66rq-4g43
The installer in the Ushahidi Platform before 2.5 omits certain calls to the exit…
Priority LOW 36
The installer in the Ushahidi Platform before 2.5 omits certain calls to the exit function, which allows remote attackers to obtain administrative privileges via unspecified vectors.
TI-2012-03002 CVE-2012-3474 · GHSA-hcf8-3vq6-r7jr
The comments API in application/libraries/api/MY_Comments_Api_Object.php in the Ushahidi…
Priority LOW 26
The comments API in application/libraries/api/MY_Comments_Api_Object.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attribu…
TI-2012-03001 CVE-2012-3473 · GHSA-mvj8-53vv-j9ff
The (1) reports API and (2) administration feature in the comments API in the Ushahidi…
Priority LOW 33
The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API fu…
TI-2012-03000 CVE-2012-3472 · GHSA-mcf8-556r-mjwr
The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi…
Priority LOW 31
The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET reques…
TI-2012-02999 CVE-2012-3471 · GHSA-g88j-r5hg-xh9v
Multiple SQL injection vulnerabilities in the edit functions in (1)…
Priority LOW 36
Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2) application/controllers/members/reports.php in the Ushahidi Platform before 2.5 allow remote attackers…
TI-2012-02998 CVE-2012-3470 · GHSA-r43c-fmg7-h9x5
Multiple SQL injection vulnerabilities in…
Priority LOW 35
Multiple SQL injection vulnerabilities in application/libraries/api/MY_Countries_Api_Object.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to _get_cou…
TI-2012-02997 CVE-2012-3469 · GHSA-hw55-mmfj-rqr3
Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote…
Priority LOW 36
Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the messages admin functionality in application/controllers/a…
TI-2012-02996 CVE-2012-3468 · GHSA-qvpv-3hvr-c7gq
Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote…
Priority LOW 36
Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the verify function in application/controllers/alerts.php, (2…