Debian DSA-2591-1 : mahara - several vulnerabilities

Multiple security issues have been found in Mahara, an electronic portfolio, weblog, and resume builder, which can result in cross-site scripting, clickjacking or arbitrary file execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

CVE-2012-2239

CVE-2012-2239 affects Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3, enabling a remote XXE injection that can read arbitrary files (e.g., config.php) or cause TCP connections. The root cause is an XML external entity flaw in Mahara’s handling of XML input. Public references in connected adviso...