CVE-2012-2243

CVE-2012-2243 is a cross-site scripting (XSS) vulnerability in Mahara versions 1.4.x before 1.4.5 and 1.5.x before 1.5.4, exploitable by uploading an XML file with the xhtml extension, which is rendered inline as script. The note indicates this can be leveraged with CVE-2012-2244 to execute arbit...

CVE-2012-6037

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the 1...

CVE-2012-2243

Cross-site scripting XSS vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to inject arbitrary web script or HTML by uploading an XML file with the xhtml extension, which is rendered inline as script. NOTE: this can be leveraged with CVE-2012-2244 to execut...

CVE-2012-2239

CVE-2012-2239 affects Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3, enabling a remote XXE injection that can read arbitrary files (e.g., config.php) or cause TCP connections. The root cause is an XML external entity flaw in Mahara’s handling of XML input. Public references in connected adviso...

CVE-2012-2247

Cross-site scripting XSS vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to artefact/file/ and a crafted SVG file...

CVE-2012-2244

CVE-2012-2244 affects Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4. The issue allows remote arbitrary code execution by an authenticated admin via manipulating the path to clamav; note it can be exploited without authentication through CVE-2012-2243. Impact per the sources is remote code exec...

CVE-2012-2253

CVE-2012-2253 is a cross-site scripting (XSS) vulnerability in Mahara, specifically in group/members.php. The flaw allows remote attackers to inject arbitrary web script or HTML via a query parameter. Affected versions are Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2. The connected documents ...

CVE-2012-2253

Cross-site scripting XSS vulnerability in group/members.php in Mahara 1.5.x before 1.5.7 and 1.6.x before 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2012-2244

Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote authenticated administrators to execute arbitrary programs by modifying the path to clamav. NOTE: this can be exploited without authentication by leveraging CVE-2012-2243...

CVE-2012-2246

CVE-2012-2246 affects Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4. The issue allows remote attackers to perform clickjacking and bypass CSRF protections to delete arbitrary users via account/delete.php. The vulnerability is described in the standard CVE details and is tied to Mahara deployme...

CVE-2012-2239

Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity XXE injection attack, as demonstrated by reading config.php...

CVE-2012-2246

Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php...

PT-2012-3898 · Catalyst It · Mahara

Name of the Vulnerable Software and Affected Versions: Mahara versions 1.4.x through 1.4.3 Mahara versions 1.5.x through 1.5.2 Description: The issue allows remote attackers to read arbitrary files or create TCP connections via an XML external entity XXE injection attack. This can be demonstrated...

Debian Security Advisory DSA 2540-1 (mahara)

The remote host is missing an update to mahara announced via advisory DSA 2540-1. OpenVAS Vulnerability Test $Id: deb25401.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2540-1 mahara Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Debian: Security Advisory (DSA-2540-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2540-1 : mahara - XSS

Emanuel Bronshtein discovered that Mahara, an electronic portfolio, weblog, and resume builder, contains multiple cross-site scripting vulnerabilities due to missing sanitization and insufficient encoding of user-supplied data. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

[SECURITY] [DSA 2540-1] mahara security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2540-1 [email protected] http://www.debian.org/security/ Raphael Geissert September 07, 2012 http://www.debian.org/security/faq -...

DSA-2540-1 mahara - cross-site scripting

Bulletin has no description...

Mahara 1.4.1 - Multiple Cross-Site Scripting HTML Injection Vulnerabilities

Mahara 1.4.1 - Multiple Cross-Site Scripting HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/54776/info Mahara is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability because it fails to properly sanitize user-supplied text. Successfu...

Mahara 1.4.1 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/54776/info Mahara is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability because it fails to properly sanitize user-supplied text. Successful exploits will allow attacker-supplied HTML and script code to run in the...