CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-6182
https://notcve.org/view.php?id=CVE-2018-6182
09 Apr 2018 — Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can create own packets of POST data containing bad content with which to hit the server. Mahara, en versiones 16.10 anteriores a la 16.10.9, versiones 17.04 anteriores a la 17.04.7 y versiones 17.10 anteriores a la 17.10.4 es vulnerable a mal... • https://bugs.launchpad.net/mahara/+bug/1744789 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2017-17455
https://notcve.org/view.php?id=CVE-2017-17455
20 Feb 2018 — Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Mahara on the HTTP protocol rather than HTTPS even when an SSL certificate is present. Mahara 16.10 en versiones anteriores a la 16.10.7, versiones 17.04 anteriores a la 17.04.5 y versiones 17.10 anteriores a la 17.10.2 es vulnerable a ser forzado, mediante un ataque Man-in-the-Middle (MitM), a interactuar con Mahara en el protocolo HTTP en lugar de HTT... • https://bugs.launchpad.net/mahara/+bug/1734767 • CWE-295: Improper Certificate Validation •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2017-17454
https://notcve.org/view.php?id=CVE-2017-17454
20 Feb 2018 — Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value. Mahara 16.10 en versiones anteriores a la 16.10.7, versiones 17.04 anter... • https://bugs.launchpad.net/mahara/+bug/1732987 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000141
https://notcve.org/view.php?id=CVE-2017-1000141
30 Jan 2018 — An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address. Se ha descubierto un problema en versiones anteriores a la 18.10.0 de Mahara. Manejaba de manera incorrecta las peticiones de los usuarios que podían interrumpir la capacida... • https://bugs.launchpad.net/mahara/+bug/1422492 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •