Catalyst It Ltd Mahara Cms 安全漏洞

Catalyst It Ltd Mahara Cms is a fully featured electronic portfolio, blog, resume builder and social networking system from Catalyst It Ltd in New Zealand. Used to connect users and create online communities. A security vulnerability exists in Catalyst It Ltd Mahara Cms that stems from an exporte...

Catalyst It Ltd Mahara Cms 代码问题漏洞

Catalyst It Ltd Mahara Cms is a fully featured electronic portfolio, blog, resume builder and social networking system from Catalyst It Ltd in New Zealand. Used to connect users and create online communities. A security vulnerability exists in Catalyst It Ltd Mahara Cms, which stems from the...

CVE-2021-43265

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element...

CVE-2021-43264

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character...

CVE-2021-43266

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution...

CVE-2021-43266

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution...

CVE-2021-43264

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character...

CVE-2021-43265

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element...

Code injection

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element...

CVE-2021-43266

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution...

Directory traversal

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character...

CVE-2021-43264

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character...

Design/Logic Flaw

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution...

CVE-2021-43265

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element...

CVE-2021-43264

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character...

CVE-2021-43264

CVE-2021-43264 affects Mahara releases prior to 20.04.5, 20.10.3, 21.04.2, and 21.10.0. The flaw is a directory traversal during page help file path handling that replaces the '-' character with '/' to bypass access control on HTML files. The connected sources confirm the affected versions and sy...

CVE-2021-43265

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element...

CVE-2021-43265

CVE-2021-43265 affects Mahara up to versions 20.04.5, 20.10.3, 21.04.2, and 21.10.0, where certain tag syntax could be used for XSS (e.g., via a SCRIPT element). Root cause: input handling accepts unsafe tag syntax. Impact: cross-site scripting risk. Remediation: upgrade to the fixed releases (e....

CVE-2021-43266

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution...

CVE-2021-43266

CVE-2021-43266 affects Mahara vulnerable to code execution when exporting collections to PDF due to shell metacharacters in collection names. Concrete details across connected docs: affected Mahara releases include before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, with additional issues in before 20...