CVE-2022-33913

CVE-2022-33913 affects Mahara: versions 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2; the issue allows files to be downloaded through thumb.php without a permission check. The Red Hat and OpenVAS datasets corroborate the same description. The root cause is missing access control on thu...

Mahara 安全漏洞

Mahara is a free open source web-based ePortfolio management system from Mahara. A security vulnerability exists in Mahara versions 21.04 through 21.04.6, 21.10 through 21.10.4, and 22.04.2, which stems from the fact that it is sometimes possible to download files via thumb.php without checking...

PT-2022-21906 · Mahara · Mahara

Name of the Vulnerable Software and Affected Versions: Mahara versions 21.04 through 21.04.5 Mahara versions 21.10 through 21.10.3 Mahara version 22.04.2 Description: The issue allows files to be downloaded through thumb.php with no permission check. Recommendations: For Mahara versions 21.04...

HTML Purifier Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-6RM6-MJMH-86JQ HTML Purifier Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Mahara has unspecified vulnerabilities

Mahara is a free and open source Web-based electronic archive management system from Mahara. security vulnerabilities exist in versions prior to Mahara 20.10.5, 21.04.4, 21.10.2 and 22.04.0, which stem from the fact that sites in the application with isolated organizations are vulnerable to attac...

Mahara < 20.10.5, 21.4.x < 21.04.4, 21.10.x < 21.10.2 Multiple Vulnerabilities

Mahara is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara"; if description...

CVE-2022-28892

Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery CSRF because randomly generated tokens are too easily guessable...

CVE-2022-29585

In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list rather than only being shown for the institution that the viewer is a member of...

CVE-2022-29584

Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets CSS class for embedly is used, and JavaScript code is constructed to perform an action...

CVE-2022-29584

Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets CSS class for embedly is used, and JavaScript code is constructed to perform an action...

CVE-2022-29585

In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list rather than only being shown for the institution that the viewer is a member of...

Cross site request forgery (csrf)

Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery CSRF because randomly generated tokens are too easily guessable...

CVE-2022-28892

Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery CSRF because randomly generated tokens are too easily guessable...

Design/Logic Flaw

Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets CSS class for embedly is used, and JavaScript code is constructed to perform an action...

Design/Logic Flaw

In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list rather than only being shown for the institution that the viewer is a member of...

CVE-2022-29585

In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list rather than only being shown for the institution that the viewer is a member of...

CVE-2022-29585

In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list rather than only being shown for the institution that the viewer is a member of...

CVE-2022-29585

CVE-2022-29585 affects Mahara versions prior to 20.10.5, 21.04.4, 21.10.2, and 22.04.0. The issue arises in sites using Isolated Institutions where, when more than ten groups are used, all groups are listed on page 2 of the group results instead of only those belonging to the viewer’s institution...

CVE-2022-29584

Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets CSS class for embedly is used, and JavaScript code is constructed to perform an action...