CVE-2010-2479

Cross-site scripting XSS vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-1670

Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 has improper configuration options for authentication plugins associated with logins that use the single sign-on SSO functionality, which allows remote attackers to bypass authentication via an empty password. NOTE: some of these...

CVE-2010-2479

Technical details for CVE-2010-2479 are not publicly provided in the connected documents. Monitor for updates; no concrete affected products, versions, or fixes are disclosed here.

CVE-2010-1667

Multiple cross-site scripting XSS vulnerabilities in Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-1669

SQL injection vulnerability in Mahara 1.1.x before 1.1.9 and 1.2.x before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2010-1670

CVE-2010-1670 affects Mahara prior to 1.0.15, 1.1.x prior to 1.1.9, and 1.2.x prior to 1.2.5, where misconfiguration options for authentication plugins used by SSO allow remote attackers to bypass authentication with an empty password. Several connected sources (Red Hat, Debian, OpenVAS entries) ...

Mahara Multiple Remote Vulnerabilities

Mahara is prone to multiple remote vulnerabilities, including: 1. Multiple HTML-injection vulnerabilities 2. A cross-site request-forgery vulnerability 3. Multiple SQL-injection vulnerabilities 4. An authentication-bypass vulnerability Exploiting these issues could allow an attacker to steal...

Debian DSA-2067-1 : mahara - several vulnerabilities

Several vulnerabilities were discovered in mahara, an electronic portfolio, weblog, and resume builder. The following Common Vulnerabilities and Exposures project ids identify them : - CVE-2010-1667 Multiple pages performed insufficient input sanitising, making them vulnerable to cross-site...

Mahara Multiple Vulnerabilities (Jul 2010)

Mahara is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara"; if description...

[SECURITY] [DSA-2067-1] New mahara packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-2067-1 [email protected] http://www.debian.org/security/ Raphael Geissert Jul 02, 2010 http://www.debian.org/security/faq -...

DSA-2067-1 mahara - several vulnerabilities

Bulletin has no description...

FreeBSD Ports: mahara

The remote host is missing an update to the system as announced in the referenced advisory. VID 5053420c-4935-11df-83fb-0015587e2cc1 OpenVAS Vulnerability Test $ Description: Auto generated from VID 5053420c-4935-11df-83fb-0015587e2cc1 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian: Security Advisory (DSA-2030-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD Ports: mahara

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD : mahara -- sql injection vulnerability (5053420c-4935-11df-83fb-0015587e2cc1)

The Debian security team reports : It was discovered that mahara, an electronic portfolio, weblog, and resume builder is not properly escaping input when generating a unique username based on a remote user name from a single sign-on application. An attacker can use this to compromise the mahara...

Debian DSA-2030-1 : mahara - sql injection

It was discovered that mahara, an electronic portfolio, weblog, and resume builder is not properly escaping input when generating a unique username based on a remote user name from a single sign-on application. An attacker can use this to compromise the mahara database via crafted user names...

Sql injection

SQL injection vulnerability in lib/user.php in mahara 1.0.4 allows remote attackers to execute arbitrary SQL commands via a username...

CVE-2010-0400

CVE-2010-0400 affects mahara 1.0.4, with a SQL injection in lib/user.php exploitable via the username. Multiple openvas/Red Hat/Debian entries confirm the issue and tie it to improper handling/escaping when generating a unique username from a remote user (SSO). Impact: remote attacker could alter...

[SECURITY] [DSA 2030-1] New mahara packages fix sql injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-2030-1 [email protected] http://www.debian.org/security/ Nico Golde April 6th, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2030-1] New mahara packages fix sql injection

-------------------------------------------------------------------------- Debian Security Advisory DSA-2030-1 [email protected] http://www.debian.org/security/ Nico Golde April 6th, 2010 http://www.debian.org/security/faq -...