CVE-2012-5618

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-640

Affected software

VendorProductVersions
UshahidiUshahidibefore 2.6.1

References

Timeline

Published
Feb 4, 2020
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2012

CVE-2012-56192.1The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which .CVE-2012-56215.0lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connCVE-2012-56226.8Cross-site request forgery (CSRF) vulnerability in the management console (openshift-console/app/controllers/application_controller.rb) in OCVE-2012-56237.5Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords.CVE-2012-56244.3The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force CVE-2012-56256.5OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical vCVE-2012-56267.5EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss PorCVE-2012-56274.0Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executioCVE-2012-56284.4gofer before 0.68 uses world-writable permissions for /var/lib/gofer/journal/watchdog, which allows local users to cause a denial of serviceCVE-2012-56297.5The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0CVE-2012-56306.3libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.CVE-2012-56318.8ipa 3.0 does not properly check server identity before sending credential containing cookies
CVE-2012-5618: Critical severity, CVSS 9.8 | Vulnix