Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3200 - http://www.securityfocus.com/bid/100267 - https://access.redhat.com/errata/RHSA-2017:2918 - https://access.redhat.com/errata/RHSA-2017:2931 - http://www.debian.org/security/2017/dsa-3981 - https://access.redhat.com/security/cve/cve-2017-1000111 - http://www.securitytracker.com/id/1039132 - https://access.redhat.com/errata/RHSA-2017:2930
CVE ID: CVE-2017-1000112 State: PUBLISHED Published: 2017-10-04T01:00:00 Last Updated: 2024-08-05T21:53:06.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len
ath and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2017/q3/277 - https://access.redhat.com/errata/RHSA-2017:3200 - http://www.securityfocus.com/bid/100262 - https://access.redhat.com/errata/RHSA-2017:2918 - https://access.redhat.com
- http://www.securityfocus.com/bid/100262 - https://access.redhat.com/errata/RHSA-2017:2918 - https://access.redhat.com/errata/RHSA-2017:2931 - http://www.debian.org/security/2017/dsa-3981 - https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-1000112 - http://www.securitytracker.com/id/1039162 - https://www.exploit-db.com/exploits/45147/ - https://access.redhat.com/errata/RHSA-2017:2930 - https://access.redhat.com/errata/RHSA-2019:1932 - https://access.redhat.com/errata/RHSA-2019:1931 - https://access.redhat.com/errata/RHSA-2019:4159
CVE ID: CVE-2017-1000113 State: PUBLISHED Published: 2017-10-04T01:00:00Z Last Updated: 2024-09-17T01:00:31.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with Credentials Plugin to store passwords securely, and automatically migrates existing passwords. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-08-07/
CVE ID: CVE-2017-1000114 State: PUBLISHED Published: 2017-10-04T01:00:00 Last Updated: 2024-08-05T21:53:06.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser extensions or cross-site scripting vulnerabilities. The Datadog Plugin now encrypts the API key transmitted to administrators viewing the global configuration form. Additional Analyst Notes: - CVE Program Container: References: - https:/
strators viewing the global configuration form. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-08-07/ - http://www.securityfocus.com/bid/100223
CVE ID: CVE-2017-1000115 State: PUBLISHED Published: 2017-10-04T01:00:00 Last Updated: 2024-08-05T21:53:06.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository Additional Analyst Notes: - CVE Program Container: References: - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29 - http://www.securityfocus.com/bid/100290 - http://www.debian.org/security/2017/dsa-3963 - https://access.redhat.com/errata/RHSA-2017:2489 - https://security.gentoo.org/glsa/201709-18
CVE ID: CVE-2017-1000116 State: PUBLISHED Published: 2017-10-04T01:00:00 Last Updated: 2024-08-05T21:53:06.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29 - http://www.securityfocus.com/bid/100290 - http://www.debian.org/security/2017/dsa-3963 - https://access.redhat.com/errata/RHSA-2017:2489 - https://security.gentoo.org/glsa/201709-18
CVE ID: CVE-2017-1000117 State: PUBLISHED Published: 2017-10-04T01:00:00 Last Updated: 2024-08-05T21:53:06.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3934 - https://access.redhat.com/
Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3934 - https://access.redhat.com/errata/RHSA-2017:2674 - http://www.securitytracker.com/id/1039131 - https://www.exploit-db.com/exploits/42599/ - https://access.redhat.com/errata/RHSA-2017:2675 - https://access.redhat.com/errata/RHSA-2017:2484 - https://access.redhat.com/errata/RHSA-2017:2491 - https://support.apple.com/HT208103 - https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html - http://www.securityfocus.com/bid/100283 - https://security.gentoo.org/glsa/201709-10 - https://access.redhat.com/errata/RHSA-2017:2485
CVE ID: CVE-2017-1000118 State: PUBLISHED Published: 2017-10-04T01:00:00Z Last Updated: 2024-09-16T23:46:56.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service Additional Analyst Notes: - CVE Program Container: References: - https://doc.akka.io/docs/akka-http/10.0.6/security/2017-05-03-illegal-media-range-in-accept-header-causes-stackoverflowerror.html
CVE ID: CVE-2017-1000119 State: PUBLISHED Published: 2017-10-04T01:00:00 Last Updated: 2024-08-05T21:53:06.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server. Additional Analyst Notes: - CVE Program Container: References: - http://octobercms.com/support/article/rn-8 - http://packetstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.html
CVE ID: CVE-2017-1000120 State: PUBLISHED Published: 2017-10-04T01:00:00Z Last Updated: 2024-09-17T01:40:58.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: [ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter. Additional Analyst Notes: - CVE Program Container: References: - http://tech.mantz-it.com/2016/12/sql-injection-in-frappe-framework.html
CVE ID: CVE-2017-1000121 State: PUBLISHED Published: 2017-11-01T21:00:00Z Last Updated: 2024-11-14T19:53:43.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://trac.webkit.org/changeset/217126/webkit
CVE ID: CVE-2017-1000122 State: PUBLISHED Published: 2017-11-01T21:00:00Z Last Updated: 2024-09-17T04:09:44.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service (release assertion) of the UI process. This vulnerability does not affect Apple products. Additional Analyst Notes: - CVE Program Container: References: - http://trac.webkit.org/changeset/217206
CVE ID: CVE-2017-1000123 State: REJECTED Published: 2017-08-21T00:00:00Z Last Updated: 2024-09-16T17:15:02.678Z Description: No description available.
CVE ID: CVE-2017-1000124 State: REJECTED Published: 2017-08-21T01:00:00Z Last Updated: 2024-09-16T20:42:43.837Z Description: No description available.
CVE ID: CVE-2017-1000125 State: PUBLISHED Published: 2017-11-17T05:00:00Z Last Updated: 2024-09-16T17:22:57.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codiad(full version) is vulnerable to write anything to configure file in the installation resulting upload a webshell. Additional Analyst Notes: - CVE Program Container: References: - http://www.jianshu.com/p/b09d20af2374
CVE ID: CVE-2017-1000126 State: PUBLISHED Published: 2017-11-17T22:00:00 Last Updated: 2024-08-05T21:53:06.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: exiv2 0.26 contains a Stack out of bounds read in webp parser Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/06/30/1 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html
CVE ID: CVE-2017-1000127 State: PUBLISHED Published: 2017-11-17T22:00:00Z Last Updated: 2024-09-16T17:03:45.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2 0.26 contains a heap buffer overflow in tiff parser Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/06/30/1
CVE ID: CVE-2017-1000128 State: PUBLISHED Published: 2017-11-17T22:00:00Z Last Updated: 2024-09-16T17:28:41.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/06/30/1
CVE ID: CVE-2017-1000129 State: PUBLISHED Published: 2017-11-17T05:00:00Z Last Updated: 2024-09-17T00:40:30.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure Additional Analyst Notes: - CVE Program Container: References: - https://blog.s9y.org/archives/269-Serendipity-2.0.4-and-2.1-beta2-released.html
CVE ID: CVE-2017-1000131 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they have been logged out of Moodle (when using MNet) as Mahara did not properly implement one of the MNet SSO API functions. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1084336
CVE ID: CVE-2017-1000132 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .swf files that can have its code executed when a user tries to download the file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1190788
CVE ID: CVE-2017-1000133 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:06.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to a user - in some circumstances causing another user's artefacts to be included in a Leap2a export of their own pages. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1234615
CVE ID: CVE-2017-1000134 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:06.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable because group members can lose access to the group files they uploaded if another group member changes the access permissions on them. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1267686
CVE ID: CVE-2017-1000135 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable as logged-in users can stay logged in after the institution they belong to is suspended. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1348024
CVE ID: CVE-2017-1000136 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:06.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable to old sessions not being invalidated after a password change. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1363873
CVE ID: CVE-2017-1000137 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when adding a text block to a page via the keyboard (rather than drag and drop). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1375092
CVE ID: CVE-2017-1000138 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:06.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when dragging/dropping files into a collection if the file has Javascript code in its title. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1377736
CVE ID: CVE-2017-1000139 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1397736
CVE ID: CVE-2017-1000140 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .xml file that can have its code executed when user tries to download the file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1404117
CVE ID: CVE-2017-1000141 State: PUBLISHED Published: 2018-01-30T19:00:00 Last Updated: 2024-08-05T21:53:07.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1422492
CVE ID: CVE-2017-1000142 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users being able to delete their submitted page through URL manipulation. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1425306
CVE ID: CVE-2017-1000143 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users receiving watchlist notifications about pages they do not have access to anymore. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1429647
CVE ID: CVE-2017-1000144 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1447377
CVE ID: CVE-2017-1000145 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to anonymous comments being able to be placed on artefact detail pages even when the site administrator had disallowed anonymous comments. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1460368
CVE ID: CVE-2017-1000146 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in user because the title of the portfolio page was not being properly escaped in the AJAX script that updates the Add/remove watchlist link on artefact detail pages. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1472439
CVE ID: CVE-2017-1000147 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into their Mahara account. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1480329
CVE ID: CVE-2017-1000148 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:06.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP "unserialize()" function when importing a skin from an XML file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1508684
CVE ID: CVE-2017-1000149 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 1.10 before 1.10.9 and 15.04 before 15.04.6 and 15.10 before 15.10.2 are vulnerable to XSS due to window.opener (target="_blank" and window.open()) Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1558361
CVE ID: CVE-2017-1000150 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1567784
CVE ID: CVE-2017-1000151 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to passwords or other sensitive information being passed by unusual parameters to end up in an error log. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1570221
CVE ID: CVE-2017-1000152 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara, such as an admin changing another user's account settings. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1570744
CVE ID: CVE-2017-1000153 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1577251
CVE ID: CVE-2017-1000154 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in login form, still allowing users to log in even if their institution was expired or suspended. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1580399