deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2744
Published: 2012-08-09
Description: net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.
CVSS Score: 7.8 (HIGH)
References: http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9e2dcf72023d1447f09c47d77c99b0c49659e5ce; http://rhn.redhat.com/errata/RHSA-2012-1064.html
CVE: CVE-2012-2745
Published: 2012-08-09
Description: The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=79549c6dfda0603dba9a70a53467ce62d9335c33; http://rhn.redhat.com/errata/RHSA-2012-1064.html; http://secunia.com/advisories/50633
CVE: CVE-2012-2862
Published: 2012-08-09
Description: Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=136643; http://code.google.com/p/chromium/issues/detail?id=137721; http://code.google.com/p/chromium/issues/detail?id=137957
CVE: CVE-2012-2863
Published: 2012-08-09
Description: The PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=136968; http://code.google.com/p/chromium/issues/detail?id=137361; http://googlechromereleases.blogspot.com/2012/08/stable-channel-update.html
CVE: CVE-2012-3463
Published: 2012-08-10
Description: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-0154.html; http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/; https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source&output=gplain
CVE: CVE-2012-3464
Published: 2012-08-10
Description: Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-0154.html; http://secunia.com/advisories/50694; http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
CVE: CVE-2012-3465
Published: 2012-08-10
Description: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-0154.html; http://secunia.com/advisories/50694; http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
CVE: CVE-2012-3554
Published: 2012-08-10
Description: SQL injection vulnerability in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/142; http://joomlacode.org/gf/project/rsgallery2/news/; http://www.rsgallery2.nl/announcements/rsgallery2_3.2.0_and_2.3.0_released_16845.0.html
CVE: CVE-2012-4071
Published: 2012-08-10
Description: Cross-site scripting (XSS) vulnerability in the comments module in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to inject arbitrary web script or HTML via crafted BBCode markup in a comment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/142; http://joomlacode.org/gf/download/frsrelease/17325/75427/com_rsgallery2_2.3.0.zip; http://joomlacode.org/gf/download/frsrelease/17326/75428/com_rsgallery2_3.2.0.zip
CVE: CVE-2012-4235
Published: 2012-08-10
Description: The RSGallery2 (com_rsgallery2) component before 3.2.0 for Joomla! 2.5.x does not place index.html files in image directories, which allows remote attackers to list image filenames via a request for a directory URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/142; http://joomlacode.org/gf/download/frsrelease/17326/75428/com_rsgallery2_3.2.0.zip; http://joomlacode.org/gf/project/rsgallery2/news/
CVE: CVE-2012-3132
Published: 2012-08-10
Description: SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and DBMS_STATS.GATHER_TABLE_STATS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.darkreading.com/database-security/167901020/security/news/240004776/hacking-oracle-database-indexes.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:150; http://www.networkworld.com/news/2012/072712-black-hat-shark-bitten-security-researcher-261203.html
CVE: CVE-2012-3457
Published: 2012-08-12
Description: PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683879; http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086161.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086387.html
CVE: CVE-2012-3952
Published: 2012-08-12
Description: Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0059.html; http://osvdb.org/84482; http://secunia.com/advisories/50150
CVE: CVE-2012-3953
Published: 2012-08-12
Description: SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0059.html; http://osvdb.org/84483; http://www.phplist.com/?lid=579
CVE: CVE-2012-4034
Published: 2012-08-12
Description: Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to the send page, (2) email parameter to the forget page, (3) password parameter to the forum_archive page, (4) section parameter to the management page, (5) section_id parameter to the managementreply page, (6) member_id parameter to the new_password page, or (7) subjectid parameter to the tags page to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/84480; http://secunia.com/advisories/50153; http://www.pbboard.com/forums/t10352.html
CVE: CVE-2012-4035
Published: 2012-08-12
Description: The new_password page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the member_id and new_password parameters to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/84481; http://secunia.com/advisories/50153; http://www.pbboard.com/forums/t10352.html
CVE: CVE-2012-4246
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.phplist.com/?lid=579; https://www.httpcs.com/advisories; https://www.httpcs.com/advisory/httpcs23
CVE: CVE-2012-4247
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import4 page; or the (6) id parameter to the bouncerule page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.phplist.com/?lid=579; https://www.httpcs.com/advisories; https://www.httpcs.com/advisory/httpcs1
CVE: CVE-2012-2577
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/50004; http://www.kb.cert.org/vuls/id/174119; http://www.securityfocus.com/bid/54624
CVE: CVE-2012-2602
Published: 2012-08-12
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/84116; http://secunia.com/advisories/50004; http://www.exploit-db.com/exploits/20011
CVE: CVE-2012-2963
Published: 2012-08-12
Description: The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication for the gwt/BugReport script, which allows remote attackers to obtain sensitive information by downloading a .tgz file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/520430; http://www.kb.cert.org/vuls/id/MAPG-8GANCC; http://www.secureworks.com/research/advisories/SWRX-2012-005/
CVE: CVE-2012-2964
Published: 2012-08-12
Description: The BreakingPoint Storm appliance before 3.0 requires cleartext credentials for establishing a session from a GUI administrative client, which allows remote attackers to obtain sensitive information by sniffing the network for XML documents.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/520430; http://www.kb.cert.org/vuls/id/MAPG-8GANCC; http://www.secureworks.com/research/advisories/SWRX-2012-006/
CVE: CVE-2012-2965
Published: 2012-08-12
Description: Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://caucho.com/resin-4.0/changes/changes.xtp; http://en.securitylab.ru/lab/; http://en.securitylab.ru/lab/PT-2012-05
CVE: CVE-2012-2966
Published: 2012-08-12
Description: Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://caucho.com/resin-4.0/changes/changes.xtp; http://en.securitylab.ru/lab/; http://en.securitylab.ru/lab/PT-2012-05
CVE: CVE-2012-2967
Published: 2012-08-12
Description: Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for comparisons, which has unspecified impact and context-dependent attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://caucho.com/resin-4.0/changes/changes.xtp; http://en.securitylab.ru/lab/; http://en.securitylab.ru/lab/PT-2012-05
CVE: CVE-2012-2968
Published: 2012-08-12
Description: Directory traversal vulnerability in Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to create files in arbitrary directories via a .. (dot dot) in a pathname within an HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://caucho.com/resin-4.0/changes/changes.xtp; http://en.securitylab.ru/lab/; http://en.securitylab.ru/lab/PT-2012-05
CVE: CVE-2012-2969
Published: 2012-08-12
Description: Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for created files via a %00 sequence in a pathname within an HTTP request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://caucho.com/resin-4.0/changes/changes.xtp; http://en.securitylab.ru/lab/; http://en.securitylab.ru/lab/PT-2012-05
CVE: CVE-2012-2584
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) the Cascading Style Sheets (CSS) expression property in conjunction with a CSS comment within the STYLE attribute of an IMG element, (2) the CSS expression property in conjunction with multiple CSS comments within the STYLE attribute of an arbitrary element, or (3) an innerHTML attribute within an XML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20357/; http://www.securityfocus.com/bid/54885; http://www.securitytracker.com/id?1027409
CVE: CVE-2012-4069
Published: 2012-08-12
Description: Dir2web 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database via a direct request for system/db/website.db.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0045.html; http://archives.neohapsis.com/archives/bugtraq/2012-08/0045.html
CVE: CVE-2012-4070
Published: 2012-08-12
Description: SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-08/0045.html; http://archives.neohapsis.com/archives/bugtraq/2012-08/0045.html
CVE: CVE-2012-4248
Published: 2012-08-12
Description: The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the (1) dev.log, (2) lipc.set, (3) lipc.get, or (4) todo.scheduleItems method, a different vulnerability than CVE-2012-4249.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.kb.cert.org/vuls/id/122656; http://www.kb.cert.org/vuls/id/MORO-8WKGBN; http://www.mobileread.com/forums/showthread.php?s=c7953cc553a4aaa36e880b25aa1a6bf6&t=175368
CVE: CVE-2012-4249
Published: 2012-08-12
Description: The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than CVE-2012-4248.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://www.kb.cert.org/vuls/id/122656; http://www.kb.cert.org/vuls/id/MORO-8WKGBN; http://www.mobileread.com/forums/showthread.php?s=c7953cc553a4aaa36e880b25aa1a6bf6&t=175368
CVE: CVE-2012-2571
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS expression property in the STYLE attribute of an arbitrary element, (4) a crafted SRC attribute of an IFRAME element, or (5) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20366/; http://www.exploit-db.com/exploits/20366/
CVE: CVE-2012-2573
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS expression property in the STYLE attribute of an arbitrary element, (4) an ONLOAD attribute of a BODY element, (5) a crafted SRC attribute of an IFRAME element, (6) a crafted CONTENT attribute of an HTTP-EQUIV="refresh" META element, or (7) a data: URL in the CONTENT attribute of an HTTP-EQUIV="refresh" META element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20364/; http://www.exploit-db.com/exploits/20364/
CVE: CVE-2012-2585
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS expression property in the STYLE attribute of an arbitrary element, or (4) a crafted SRC attribute of an IFRAME element, or an e-mail message subject with (5) a SCRIPT element, (6) a CSS expression property in the STYLE attribute of an arbitrary element, (7) a crafted SRC attribute of an IFRAME element, (8) a crafted CONTENT attribute of an HTTP-EQUIV="refresh" META element, or (9) a data: URL in the CONTENT attribute of an HTTP-EQUIV="refresh" META element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20356/; http://www.exploit-db.com/exploits/20356/
CVE: CVE-2012-2587
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted SRC attribute of (1) an IFRAME element or (2) a SCRIPT element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20352/; http://www.exploit-db.com/exploits/20352/
CVE: CVE-2012-2590
Published: 2012-08-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted SRC attribute of an IFRAME element, (3) a crafted CONTENT attribute of an HTTP-EQUIV="Set-Cookie" META element, or (4) an innerHTML attribute within an XML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/20350/; http://www.exploit-db.com/exploits/20350/
CVE: CVE-2012-3468
Published: 2012-08-12
Description: Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the verify function in application/controllers/alerts.php, (2) the save_all function in application/models/settings.php, or (3) the media type to the timeline function in application/controllers/json.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://openwall.com/lists/oss-security/2012/08/09/5; https://github.com/ushahidi/Ushahidi_Web/commit/4764792; https://github.com/ushahidi/Ushahidi_Web/commit/d954093
CVE: CVE-2012-3469
Published: 2012-08-12
Description: Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the messages admin functionality in application/controllers/admin/messages.php, (2) application/libraries/api/MY_Checkin_Api_Object.php, (3) application/controllers/admin/messages/reporters.php, or (4) the location API in application/libraries/api/MY_Locations_Api_Object.php and application/models/location.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://openwall.com/lists/oss-security/2012/08/09/5; https://github.com/ushahidi/Ushahidi_Web/commit/68d9916; https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919
CVE: CVE-2012-3470
Published: 2012-08-12
Description: Multiple SQL injection vulnerabilities in application/libraries/api/MY_Countries_Api_Object.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to _get_countries functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://openwall.com/lists/oss-security/2012/08/09/5; https://github.com/ushahidi/Ushahidi_Web/commit/3301e48; http://openwall.com/lists/oss-security/2012/08/09/5
CVE: CVE-2012-3471
Published: 2012-08-12
Description: Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2) application/controllers/members/reports.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via an incident id.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://openwall.com/lists/oss-security/2012/08/09/5; https://github.com/ushahidi/Ushahidi_Web/commit/3f14fa0; http://openwall.com/lists/oss-security/2012/08/09/5
CVE: CVE-2012-3472
Published: 2012-08-12
Description: The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET request.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://openwall.com/lists/oss-security/2012/08/09/5; https://github.com/ushahidi/Ushahidi_Web/commit/4c24325; http://openwall.com/lists/oss-security/2012/08/09/5
CVE: CVE-2012-3473
Published: 2012-08-12
Description: The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://openwall.com/lists/oss-security/2012/08/09/5; https://github.com/ushahidi/Ushahidi_Web/commit/13ca6f4; https://github.com/ushahidi/Ushahidi_Web/commit/f67f4ad
CVE: CVE-2012-3474
Published: 2012-08-12
Description: The comments API in application/libraries/api/MY_Comments_Api_Object.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://openwall.com/lists/oss-security/2012/08/09/5; https://github.com/ushahidi/Ushahidi_Web/commit/529f353; http://openwall.com/lists/oss-security/2012/08/09/5
CVE: CVE-2012-3475
Published: 2012-08-12
Description: The installer in the Ushahidi Platform before 2.5 omits certain calls to the exit function, which allows remote attackers to obtain administrative privileges via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://openwall.com/lists/oss-security/2012/08/09/5; https://github.com/ushahidi/Ushahidi_Web/commit/7892559; https://github.com/ushahidi/Ushahidi_Web/commit/fcdad03