CVE-2011-1405

Cross-site scripting XSS vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php...

Information disclosure

Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with 1 blocktype/myfriends/myfriends.json.php, 2 json/usersearch.php, 3 group/membersearchresults.json.php, or 4...

Cross site scripting

Cross-site scripting XSS vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the pieforms implementation in Mahara before 1.3.6 allows remote attackers to hijack the authentication of arbitrary users for requests to any form, related to inappropriate regeneration of session keys...

CVE-2011-1402

Mahara prior to 1.3.6 is affected by CVE-2011-1402 (and related CVEs). The issue stems from incorrect privilege enforcement, a missing user-id check, and improper handling of the Overriding Start/Stop Dates setting, allowing remote authenticated users to bypass restrictions and perform actions ac...

CVE-2011-1402

Mahara before 1.3.6 allows remote authenticated users to bypass intended access restrictions, and suspend a user account, edit a view, visit a view, edit a plan artefact, read a plans block, read a plan artefact, edit a blog, read a blog block, read a blog artefact, or access a block, via a reque...

CVE-2011-1403

CVE-2011-1403 is a CSRF-related vulnerability in Mahara due to a misconfiguration of the Pieform package, causing the CSRF protection mechanism to be effectively disabled. This could allow attackers to trick other users (e.g., administrators) into performing actions on behalf of the attacker. Aff...

CVE-2011-1406

Mahara before 1.3.6 does not properly handle an https URL in the wwwroot configuration setting, which makes it easier for user-assisted remote attackers to obtain credentials by sniffing the network at a time when an http URL is used for a login...

CVE-2011-1406

CVE-2011-1406 affects Mahara prior to 1.3.6. If wwwroot is configured to HTTPS but the web server serves content over HTTP as well, users can log in via HTTP and credentials may be sniffed. Debian/OpenVAS advisories mirror this issue and recommend upgrading Mahara to the fixed version (1.3.6 or l...

CVE-2011-1405

Mahara is affected by CVE-2011-1405 (and related CVEs) up to version

CVE-2011-1404

Mahara prior to version 1.3.6 is affected by CVE-2011-1404, where JSON responses exposed more information than necessary in AJAX endpoints (blocktype/myfriends/myfriends.json.php, json/usersearch.php, group/membersearchresults.json.php, json/friendsearch.php). The issue is an information disclosu...

CVE-2011-1403

Cross-site request forgery CSRF vulnerability in the pieforms implementation in Mahara before 1.3.6 allows remote attackers to hijack the authentication of arbitrary users for requests to any form, related to inappropriate regeneration of session keys...

CVE-2011-1404

Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with 1 blocktype/myfriends/myfriends.json.php, 2 json/usersearch.php, 3 group/membersearchresults.json.php, or 4...

CVE-2011-1405

Cross-site scripting XSS vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php...

Debian: Security Advisory (DSA-2206-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2206-1 (mahara)

The remote host is missing an update to mahara announced via advisory DSA 2206-1. OpenVAS Vulnerability Test $Id: deb22061.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2206-1 mahara Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Mahara Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

This host is running Mahara and is prone to cross site scripting and cross site request forgery vulnerabilities. OpenVAS Vulnerability Test $Id: secpodmaharaxssncsrfvuln.nasl 7029 2017-08-31 11:51:40Z teissa $ Mahara Cross Site Scripting and Cross Site Request Forgery Vulnerabilities Authors:...

Mahara Multiple Vulnerabilities (Apr 2011)

Mahara is prone to multiple cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

[SECURITY] [DSA 2206-1] New mahara packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 2206-1 [email protected] http://www.debian.org/security/ Martin Schulze March 29th, 2011 http://www.debian.org/security/faq -...

Debian DSA-2206-1 : mahara - several vulnerabilities

Two security vulnerabilities have been discovered in Mahara, a fully featured electronic portfolio, weblog, resume builder and social networking system : - CVE-2011-0439 A security review commissioned by a Mahara user discovered that Mahara processes unsanitized input which can lead to cross-site...