CVE-2017-1000157

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the event_log table during the user creation process if full event logging was turned on.

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10001589.8CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in CVE-2017-10001597.8Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.CVE-2017-10001605.4EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection CVE-2017-10001636.1The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redir CVE-2017-10001645.4Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalation CVE-2017-10001686.5sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys CVE-2017-10001699.8QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes which can lead to remote code execution. This can lead to the complete tak CVE-2017-10001707.5jqueryFileTree 2.1.5 and older Directory Traversal CVE-2017-10001719.8Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text.CVE-2017-10001729.8Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. An example of a Heap-Use-After-Free after the 'sublexer' pointer has b CVE-2017-10001739.8Creolabs Gravity Version: 1.0 Heap Overflow Potential Code Execution. By creating a large loop whiling pushing data to a buffer, we can brea CVE-2017-10001745.5In SWFTools, an address access exception was found in swfdump swf_GetBits().