Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 31 Jul 2012 12:22:16 +1200
From: Robbie MacKay <robbie@...ahidi.com>
To: oss-security@...ts.openwall.com
Cc: Heather Leson <HLeson@...ahidi.com>
Subject: CVE request for Ushahidi

The Ushahidi team have been notified of the following security
vulnerabilities thanks to volunteers from OWASP Portland.
These will be fixed in the upcoming 2.5 release.
Could you please allocate CVEs for the following issues?

* Multiple SQL injections (Reported by Timothy D. Morgan, Kees Cook,
postmodern )
https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1
https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919
https://github.com/ushahidi/Ushahidi_Web/commit/4764792
https://github.com/ushahidi/Ushahidi_Web/commit/d954093
https://github.com/ushahidi/Ushahidi_Web/commit/3301e48
https://github.com/ushahidi/Ushahidi_Web/commit/68d9916
https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66
https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c
https://github.com/ushahidi/Ushahidi_Web/commit/3f14fa0

* Missing authentication on comments, reports, email API calls
(Reported by Kees
Cook, Dennison Williams)
https://github.com/ushahidi/Ushahidi_Web/commit/4c24325
https://github.com/ushahidi/Ushahidi_Web/commit/f67f4ad

* User details exposed in comments API (Discovered by internal dev team)
https://github.com/ushahidi/Ushahidi_Web/commit/529f353

* Admin user hijacking through the installer (Reported by Wil Clouser)
https://github.com/ushahidi/Ushahidi_Web/commit/7892559
https://github.com/ushahidi/Ushahidi_Web/commit/fcdad03

* Stored XSS on member profile pages (Reported by Amy K. Farrell)
https://github.com/ushahidi/Ushahidi_Web/commit/00eae4f

Thanks in advance,

Robbie Mackay

Software Developer, External Projects
Ushahidi Inc
e: robbie@...ahidi.com
skype: robbie.mackay

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.