Page 2 of 95 results (0.000 seconds)

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2

CVE-2021-29349

https://notcve.org/view.php?id=CVE-2021-29349

31 Mar 2021 — Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieform_delete_all_notifications request, which leads to removing all messages from a mailbox. Mahara versión 20.10 está afectado por un vulnerabilidad de tipo Cross Site Request Forgery (CSRF) que permite a un atacante remoto eliminar el correo d... • https://github.com/Vulnmachines/CVE-2021-29349 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0

CVE-2020-15907

https://notcve.org/view.php?id=CVE-2020-15907

07 Aug 2020 — In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or folder names containing JavaScript. En Mahara versiones 19.04 anteriores a 19.04.6, versiones 19.10 anteriores a 19.10.4 y versiones 20.04 anteriores a 20.04.1, determinados lugares podían ejecutar nombres de archivos o carpetas que contienen JavaScript • https://bugs.launchpad.net/mahara/+bug/1888163 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2020-9387

https://notcve.org/view.php?id=CVE-2020-9387

30 Apr 2020 — In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on. En Mahara versiones 19.04 anteriores a la versión 19.04.5 y versiones 19.10 anteriores a la versión 19.10.3, los detalles de cuentas son compartidos en los resultados de Elasticsearch para las cuentas que no son accesibles cuando el ajuste de configuración "Isolated institutions" está activado. • https://bugs.launchpad.net/mahara/+bug/1836984 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2020-9386

https://notcve.org/view.php?id=CVE-2020-9386

09 Mar 2020 — In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore. En Mahara versiones 18.10 anteriores a 18.10.5, versiones 19.04 anteriores a 19.04.4 y versiones 19.10 anteriores a 19.10.2, la información de metadatos de archivo es revelada a los miembros del grupo en la lista de resultados de Elasticsearch a pesar de que ya no tienen acceso a ese a... • https://bugs.launchpad.net/mahara/+bug/1840201 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2020-9282

https://notcve.org/view.php?id=CVE-2020-9282

09 Mar 2020 — In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discoverable inspecting network responses on the 'Edit access' screen when sharing portfolios. En Mahara versiones 18.10 anteriores a 18.10.5, versiones 19.04 anteriores a 19.04.4 y versiones 19.10 anteriores a 19.10.2, una determinada información personal puede ser detectada inspeccionando las respuestas de red en la pantalla "Edit access" cuando se comparten portafolios. • https://bugs.launchpad.net/mahara/+bug/1863043 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 5%CPEs: 3EXPL: 4

CVE-2012-2237 – Mahara 1.4.1 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities

https://notcve.org/view.php?id=CVE-2012-2237

13 Nov 2019 — Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms, (2) links or (3) resources URLs, and (4) the Display name in a user profile. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en Mahara versiones 1.4.x anteriores a la versión 1.4.3 y versiones 1.5.x anteriores a la versión 1.5.2, permiten a atacan... • https://www.exploit-db.com/exploits/37565 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2013-1426

https://notcve.org/view.php?id=CVE-2013-1426

07 Nov 2019 — Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor. Un ataque de tipo Cross-site Scripting (XSS) en Mahara versiones anteriores a 1.5.9 y versiones 1.6.x anteriores a 1.6.4, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del editor TinyMCE. • https://bugs.launchpad.net/mahara/+bug/1153423 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 1

CVE-2019-9708

https://notcve.org/view.php?id=CVE-2019-9708

07 May 2019 — An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. A site administrator can suspend the system user (root), causing all users to be locked out from the system. Fue encontrado un problema en Mahara versión 17.10 anterior de 17.10.8, versión 18.04 anterior de 18.04.4 y versión 18.10 anterior de 18.10.1. Un administrador del sitio puede suspender al usuario del sistema (root), lo que conlleva a que todos los usuarios sean bloqueados fuera del sistema. • https://bugs.launchpad.net/mahara/+bug/1817221 •

CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0

CVE-2019-9709

https://notcve.org/view.php?id=CVE-2019-9709

07 May 2019 — An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting (XSS) due to not escaping it when viewing the collection's SmartEvidence overview page (if that feature is turned on). This can be exploited by any logged-in user. Fue encontrado un problema en Mahara versión 17.10 anterior de 17.10.8, versión 18.04 anterior de 18.04.4 y versión 18.10 anterior de 18.10.1. El título collection es vulnerable a Cross... • https://bugs.launchpad.net/bugs/1819547 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2018-11195

https://notcve.org/view.php?id=CVE-2018-11195

01 Jun 2018 — Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious users with physical access to the web browser of a Mahara user, after they have logged in, to potentially gain access to their Mahara credentials. Mahara, en versiones 17.04 anteriores a la 17.04.8, versiones 17.10 anteriores a la 17.10.5 y versiones 18.04 anteriores a la 18.04.1 es vulnerable a un ataque "back and refresh" del navegador. Esto permite q... • https://bugs.launchpad.net/mahara/+bug/1770561 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •