[SECURITY] [DSA 2206-1] New mahara packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 2206-1 [email protected] http://www.debian.org/security/ Martin Schulze March 29th, 2011 http://www.debian.org/security/faq -...

Mahara跨站脚本和跨站请求伪造漏洞

Bugtraq ID: 47033 CVE ID：CVE-2011-0439 Mahara是一款开源的电子文件夹，网络日志，履历表生成器和社会化网络系统。 Mahara存在多个输入验证错误，攻击者可以利用漏洞获得敏感信息或劫持目标用户会话。 -应用程序存在跨站请求伪造漏洞，攻击者可以构建恶意链接，诱使管理员访问，删除博客日志。 -通过Pieform选择框选项传递的输入在显示给用户之前缺少正确过滤，可被利用注入任意HTML和脚本代码，导致恶意数据查看时在目标用户浏览器上执行恶意代码。 Mahara Mahara 1.3.3 Mahara Mahara 1.2.5 Mahara Mahara...

DSA-2206-1 mahara - several

Bulletin has no description...

CVE-2011-0440

Cross-site request forgery CSRF vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs...

CVE-2011-0439

Cross-site scripting XSS vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the Pieforms select box...

CVE-2011-0439

Cross-site scripting XSS vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the Pieforms select box...

Cross site scripting

Cross-site scripting XSS vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the Pieforms select box...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs...

CVE-2011-0440

Cross-site request forgery CSRF vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs...

CVE-2011-0440

Cross-site request forgery CSRF vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs...

CVE-2011-0439

Cross-site scripting XSS vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the Pieforms select box...

CVE-2011-0440

Mahara is affected by CVE-2011-0440: a CSRF vulnerability in Mahara 1.2.x (before 1.2.7) and 1.3.x (before 1.3.4) allows an attacker to hijack a user’s session and perform blog deletions via forged requests. The OpenVAS entries corroborate multiple Mahara vulnerabilities tied to CVE-2011-0440, an...

CVE-2011-0439

CVE-2011-0439 affects Mahara; OpenVAS entries corroborate two issues: (1) XSS via unsanitized input in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4, (2) CVRF-equivalent risk (CVE-2011-0440) where session key checks may fail, enabling blog deletions. CVE-2011-0439’s impact is reflected as part...

CVE-2010-3871

Cross-site scripting XSS vulnerability in blocktype/groupviews/theme/raw/groupviews.tpl in Mahara before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in blocktype/groupviews/theme/raw/groupviews.tpl in Mahara before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2010-3871

Cross-site scripting XSS vulnerability in blocktype/groupviews/theme/raw/groupviews.tpl in Mahara before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2010-3871

Cross-site scripting XSS vulnerability in blocktype/groupviews/theme/raw/groupviews.tpl in Mahara before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2010-3871

CVE-2010-3871 is a reported XSS vulnerability in Mahara prior to version 1.3.3, affecting the template blocktype/groupviews/theme/raw/groupviews.tpl. The underlying issue is improper sanitization of user input, allowing remote attackers to inject arbitrary script/HTML via unspecified vectors. Pub...

Mahara < 1.3.3 XSS Vulnerability

Mahara is prone to a cross-site scripting XSS vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Mahara 'groupviews.tpl' Cross Site Scripting Vulnerability

Mahara is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker...