Page 7 of 47 results (0.012 seconds)

CVSS: 5.8EPSS: 0%CPEs: 24EXPL: 0

CVE-2011-0440

https://notcve.org/view.php?id=CVE-2011-0440

Cross-site request forgery (CSRF) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Mahara v1.2.x anteriores a v1.2.7 y v1.3.x anteriores a V1.3.4 , permite a atacantes remotos secuestrar la autenticación de los administradores para peticiones de borrado de Blogs. • http://mahara.org/interaction/forum/topic.php?id=3206 http://mahara.org/interaction/forum/topic.php?id=3208 http://secunia.com/advisories/43858 http://www.debian.org/security/2011/dsa-2206 http://www.securityfocus.com/bid/47033 https://exchange.xforce.ibmcloud.com/vulnerabilities/66326 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 0

CVE-2011-0439

https://notcve.org/view.php?id=CVE-2011-0439

Cross-site scripting (XSS) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the Pieforms select box. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Mahara v1.2.x anteriores a v1.2.7 y v1.3.x anteriores a 1.3.4, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de la caja de selección de Pieforms. • http://mahara.org/interaction/forum/topic.php?id=3205 http://mahara.org/interaction/forum/topic.php?id=3208 http://secunia.com/advisories/43858 http://www.debian.org/security/2011/dsa-2206 http://www.securityfocus.com/bid/47033 https://exchange.xforce.ibmcloud.com/vulnerabilities/66327 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 62EXPL: 0

CVE-2010-3871

https://notcve.org/view.php?id=CVE-2010-3871

Cross-site scripting (XSS) vulnerability in blocktype/groupviews/theme/raw/groupviews.tpl in Mahara before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados en blocktype/groupviews/theme/raw/groupviews.tpl En Mahara anterior v1.3.3 permite a atacantes remotos inyectar código web o HTML de su elección a tarvés de vectores no especificados. NOTA: algunos de estos detalles han sido obtenidos de terceras partes. • http://secunia.com/advisories/42152 http://wiki.mahara.org/Release_Notes/1.3.3 http://www.securityfocus.com/bid/44705 https://exchange.xforce.ibmcloud.com/vulnerabilities/63052 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 31EXPL: 0

CVE-2010-1669

https://notcve.org/view.php?id=CVE-2010-1669

SQL injection vulnerability in Mahara 1.1.x before 1.1.9 and 1.2.x before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en Mahara v1.1.x anterior a v1.1.9 y v1.2.x anterior v1.2.5 permite a los atacantes remotos ejecutar a su elección comandos SQL a través de vectores no especificados. • http://secunia.com/advisories/40431 http://wiki.mahara.org/Release_Notes/1.1.9 http://wiki.mahara.org/Release_Notes/1.2.5 http://www.securityfocus.com/bid/41319 https://exchange.xforce.ibmcloud.com/vulnerabilities/59995 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.5EPSS: 1%CPEs: 49EXPL: 0

CVE-2010-1670

https://notcve.org/view.php?id=CVE-2010-1670

Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 has improper configuration options for authentication plugins associated with logins that use the single sign-on (SSO) functionality, which allows remote attackers to bypass authentication via an empty password. NOTE: some of these details are obtained from third party information. Mahara anterior v1.0.15, v1.1.x anterior v1.1.9, y v1.2.x anterior v1.2.5 posee opciones de configuración inadecuadas para plugins de autenticación asociados con identificaciones que usa la funcionalidad single sign-on (SSO), permitiendo a atacantes remotos superar la autenticación a través de una password vacía. NOTA: algunos de estos detalles han sido obtenidos de información de terceros. • http://secunia.com/advisories/40431 http://wiki.mahara.org/Release_Notes/1.0.15 http://wiki.mahara.org/Release_Notes/1.1.9 http://wiki.mahara.org/Release_Notes/1.2.5 http://www.securityfocus.com/bid/41319 • CWE-287: Improper Authentication •