CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-6182
https://notcve.org/view.php?id=CVE-2018-6182
09 Apr 2018 — Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can create own packets of POST data containing bad content with which to hit the server. Mahara, en versiones 16.10 anteriores a la 16.10.9, versiones 17.04 anteriores a la 17.04.7 y versiones 17.10 anteriores a la 17.10.4 es vulnerable a mal... • https://bugs.launchpad.net/mahara/+bug/1744789 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2017-17454
https://notcve.org/view.php?id=CVE-2017-17454
20 Feb 2018 — Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value. Mahara 16.10 en versiones anteriores a la 16.10.7, versiones 17.04 anter... • https://bugs.launchpad.net/mahara/+bug/1732987 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2017-17455
https://notcve.org/view.php?id=CVE-2017-17455
20 Feb 2018 — Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Mahara on the HTTP protocol rather than HTTPS even when an SSL certificate is present. Mahara 16.10 en versiones anteriores a la 16.10.7, versiones 17.04 anteriores a la 17.04.5 y versiones 17.10 anteriores a la 17.10.2 es vulnerable a ser forzado, mediante un ataque Man-in-the-Middle (MitM), a interactuar con Mahara en el protocolo HTTP en lugar de HTT... • https://bugs.launchpad.net/mahara/+bug/1734767 • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000141
https://notcve.org/view.php?id=CVE-2017-1000141
30 Jan 2018 — An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address. Se ha descubierto un problema en versiones anteriores a la 18.10.0 de Mahara. Manejaba de manera incorrecta las peticiones de los usuarios que podían interrumpir la capacida... • https://bugs.launchpad.net/mahara/+bug/1422492 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 6.5EPSS: 0%CPEs: 18EXPL: 1CVE-2017-1000131
https://notcve.org/view.php?id=CVE-2017-1000131
03 Nov 2017 — Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they have been logged out of Moodle (when using MNet) as Mahara did not properly implement one of the MNet SSO API functions. Mahara, en versiones 15.04 anteriores a la 15.04.8, versiones 15.10 anteriores a la 15.10.4 y versiones 16.04 anteriores a la 16.04.2, es vulnerable a que los usuarios permanezcan con la sesión iniciada en su cuenta de Mahara inclus... • https://bugs.launchpad.net/mahara/+bug/1084336 • CWE-613: Insufficient Session Expiration •
CVSS: 4.8EPSS: 0%CPEs: 21EXPL: 1CVE-2017-1000132
https://notcve.org/view.php?id=CVE-2017-1000132
03 Nov 2017 — Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .swf files that can have its code executed when a user tries to download the file. Mahara, en versiones 1.8 anteriores a la 1.8.7, versiones 1.9 anteriores a la 1.9.5, versiones 1.10 anteriores a la 1.10.3 y versiones 15.04 anteriores a la 15.04.0, es vulnerable a que archivos .swf creados con fines maliciosos ejecuten su código cuando un usuario intenta descargar el archivo. • https://bugs.launchpad.net/mahara/+bug/1190788 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2017-1000133
https://notcve.org/view.php?id=CVE-2017-1000133
03 Nov 2017 — Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to a user - in some circumstances causing another user's artefacts to be included in a Leap2a export of their own pages. Mahara, en versiones 15.04 anteriores a la 15.04.8, versiones 15.10 anteriores a la 15.10.4 y versiones 16.04 anteriores a la 16.04.2, es vulnerable a que, en algunas circunstancias, un usuario provoque que se incluyan los artefactos de otro usuario en una exportación Leap2a de sus propias páginas... • https://bugs.launchpad.net/mahara/+bug/1234615 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 0%CPEs: 17EXPL: 1CVE-2017-1000134
https://notcve.org/view.php?id=CVE-2017-1000134
03 Nov 2017 — Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable because group members can lose access to the group files they uploaded if another group member changes the access permissions on them. Mahara, en versiones 1.8 anteriores a la 1.8.6, versiones 1.9 anteriores a la 1.9.4, versiones 1.10 anteriores a la 1.10.1 y versiones 15.04 anteriores a la 15.04.0, es vulnerable debido a que los miembros del grupo pueden perder acceso a los archivos del grupo que sub... • https://bugs.launchpad.net/mahara/+bug/1267686 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 21EXPL: 1CVE-2017-1000135
https://notcve.org/view.php?id=CVE-2017-1000135
03 Nov 2017 — Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable as logged-in users can stay logged in after the institution they belong to is suspended. Mahara, en versiones 1.8 anteriores a la 1.8.7, versiones 1.9 anteriores a la 1.9.5, versiones 1.10 anteriores a la 1.10.3 y versiones 15.04 anteriores a la 15.04.0, es vulnerable debido a que los usuarios que han iniciado sesión pueden permanecer con la sesión iniciada después de que se suspenda la institución a ... • https://bugs.launchpad.net/mahara/+bug/1348024 • CWE-613: Insufficient Session Expiration •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1CVE-2017-1000137
https://notcve.org/view.php?id=CVE-2017-1000137
03 Nov 2017 — Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when adding a text block to a page via the keyboard (rather than drag and drop). Mahara, en versiones 1.10 anteriores a la 1.10.0 y versiones 15.04 anteriores a la 15.04.0, es vulnerable a un posible Cross-Site Scripting (XSS) cuando se añade un bloque de texto a una página utilizando el teclado (en lugar de arrastrando y soltando). • https://bugs.launchpad.net/mahara/+bug/1375092 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •