CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2010-0400
https://notcve.org/view.php?id=CVE-2010-0400
SQL injection vulnerability in lib/user.php in mahara 1.0.4 allows remote attackers to execute arbitrary SQL commands via a username. Vulnerabilidad de inyección SQL en lib/user.php en mahara v1.0.4, permite a atacantes remotos ejecutar comandos SQL de su elección a través del "username". • http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny5.diff.gz http://www.debian.org/security/2010/dsa-2030 http://www.securityfocus.com/bid/39253 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 28EXPL: 0CVE-2009-3298
https://notcve.org/view.php?id=CVE-2009-3298
Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors. Mahara anterior a v1.0.13, y v1.1.x anterior a v1.1.7, permite a administradores "institution" autenticados remotamente restablecer las contraseñas de los administradores del sitio web a través de vectores no especificados. • http://eduforge.org/frs/shownotes.php?release_id=546 http://eduforge.org/frs/shownotes.php?release_id=547 http://mahara.org/interaction/forum/topic.php?id=1169 http://secunia.com/advisories/37217 http://secunia.com/advisories/37218 http://www.debian.org/security/2009/dsa-1924 http://www.osvdb.org/59584 http://www.securityfocus.com/bid/36893 http://www.vupen.com/english/advisories/2009/3101 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 21EXPL: 0CVE-2009-3299
https://notcve.org/view.php?id=CVE-2009-3299
Cross-site scripting (XSS) vulnerability in the resume blocktype in Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en el resume blocktype en Mahara anterior a v1.0.13, y v1.1.x anterior a v1.1.7, permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elección a través de vectores no especificados. • http://eduforge.org/frs/shownotes.php?release_id=546 http://eduforge.org/frs/shownotes.php?release_id=547 http://mahara.org/interaction/forum/topic.php?id=1170 http://secunia.com/advisories/37217 http://secunia.com/advisories/37218 http://www.debian.org/security/2009/dsa-1924 http://www.osvdb.org/59583 http://www.securityfocus.com/bid/36892 http://www.vupen.com/english/advisories/2009/3101 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 5EXPL: 0CVE-2009-2171
https://notcve.org/view.php?id=CVE-2009-2171
Mahara 1.1 before 1.1.5 does not apply permission checks when saving a view that contains artefacts, which allows remote authenticated users to read another user's artefact. Mahara v1.1 antes de v1.1.5 no realiza comprobaciones de permisos al guardar una vista que contiene objetos, lo que permite a los usuarios remotos autenticados leer el objeto de otro usuario. • http://mahara.org/interaction/forum/topic.php?id=753 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 0CVE-2009-2170
https://notcve.org/view.php?id=CVE-2009-2170
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0 before 1.0.12 and 1.1 before 1.1.5 allow remote attackers to inject arbitrary web script or HTML via unknown vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en Mahara v1.0 antes de v1.0.12 y v1.1 antes de v1.1.5 permite a atacantes remotos inyectar HTML o scripts web arbitrarios a través de vectores desconocidos. • http://mahara.org/interaction/forum/topic.php?id=752 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •