Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

mahara mahara 15.04.0 vulnerabilities and exploits

(subscribe to this query)
6.5
CVSSv2
CVE-2017-1000150
Mahara 15.04 prior to 15.04.7 and 15.10 prior to 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks.
Mahara Mahara 15.04.4Mahara Mahara 15.04Mahara Mahara 15.04.0Mahara Mahara 15.04.1Mahara Mahara 15.04.2Mahara Mahara 15.04.6Mahara Mahara 15.04.3Mahara Mahara 15.04.5Mahara Mahara 15.10.0Mahara Mahara 15.10.1Mahara Mahara 15.10.2
7.5
CVSSv2
CVE-2017-1000152
Mahara 15.04 prior to 15.04.7 and 15.10 prior to 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. This situation can occur when a user takes an action that forces another user to be logged ...
Mahara Mahara 15.04Mahara Mahara 15.04.0Mahara Mahara 15.04.5Mahara Mahara 15.04.1Mahara Mahara 15.04.2Mahara Mahara 15.04.3Mahara Mahara 15.04.4Mahara Mahara 15.04.6Mahara Mahara 15.10.1Mahara Mahara 15.10.2Mahara Mahara 15.10.0
3.5
CVSSv2
CVE-2017-1000144
Mahara 1.9 prior to 1.9.6 and 1.10 prior to 1.10.4 and 15.04 prior to 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages...
Mahara Mahara 1.9.3Mahara Mahara 1.9Mahara Mahara 1.9.4Mahara Mahara 1.9.5Mahara Mahara 1.9.1Mahara Mahara 1.9.2Mahara Mahara 1.9.0Mahara Mahara 1.10.1Mahara Mahara 1.10.2Mahara Mahara 1.10.3Mahara Mahara 1.10Mahara Mahara 1.10.0Mahara Mahara 15.04Mahara Mahara 15.04.0
4
CVSSv2
CVE-2017-1000131
Mahara 15.04 prior to 15.04.8 and 15.10 prior to 15.10.4 and 16.04 prior to 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they have been logged out of Moodle (when using MNet) as Mahara did not properly implement one of the MNet SSO API funct...
Mahara Mahara 15.04Mahara Mahara 15.04.6Mahara Mahara 15.04.7Mahara Mahara 15.04.3Mahara Mahara 15.04.5Mahara Mahara 15.04.0Mahara Mahara 15.04.1Mahara Mahara 15.04.2Mahara Mahara 15.04.4Mahara Mahara 16.04Mahara Mahara 16.04.1Mahara Mahara 16.04.0Mahara Mahara 15.10.0Mahara Mahara 15.10.1Mahara Mahara 15.10.2Mahara Mahara 15.10.3
5
CVSSv2
CVE-2017-1000133
Mahara 15.04 prior to 15.04.8 and 15.10 prior to 15.10.4 and 16.04 prior to 16.04.2 are vulnerable to a user - in some circumstances causing another user's artefacts to be included in a Leap2a export of their own pages.
Mahara Mahara 15.04.0Mahara Mahara 15.04.2Mahara Mahara 15.04.3Mahara Mahara 15.04.4Mahara Mahara 15.04.5Mahara Mahara 15.04.6Mahara Mahara 15.04.7Mahara Mahara 15.04Mahara Mahara 15.04.1Mahara Mahara 16.04Mahara Mahara 16.04.0Mahara Mahara 16.04.1Mahara Mahara 15.10.2Mahara Mahara 15.10.0Mahara Mahara 15.10.1Mahara Mahara 15.10.3
4
CVSSv2
CVE-2017-1000155
Mahara 15.04 prior to 15.04.8 and 15.10 prior to 15.10.4 and 16.04 prior to 16.04.2 are vulnerable to profile pictures being accessed without any access control checks consequently allowing any of a user's uploaded profile pictures to be viewable by anyone, whether or not th...
Mahara Mahara 15.04Mahara Mahara 15.04.4Mahara Mahara 15.04.6Mahara Mahara 15.04.0Mahara Mahara 15.04.1Mahara Mahara 15.04.2Mahara Mahara 15.04.3Mahara Mahara 15.04.5Mahara Mahara 15.04.7Mahara Mahara 16.04Mahara Mahara 16.04.0Mahara Mahara 16.04.1Mahara Mahara 15.10.1Mahara Mahara 15.10.3Mahara Mahara 15.10.0Mahara Mahara 15.10.2
6.5
CVSSv2
CVE-2017-1000148
Mahara 15.04 prior to 15.04.8 and 15.10 prior to 15.10.4 and 16.04 prior to 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP "unserialize()" function when importing a skin from an XML file.
Mahara Mahara 15.04.2Mahara Mahara 15.04.3Mahara Mahara 15.04.4Mahara Mahara 15.04.5Mahara Mahara 15.04Mahara Mahara 15.04.1Mahara Mahara 15.04.6Mahara Mahara 15.04.0Mahara Mahara 15.04.7Mahara Mahara 16.04Mahara Mahara 16.04.0Mahara Mahara 16.04.1Mahara Mahara 15.10.1Mahara Mahara 15.10.3Mahara Mahara 15.10.0Mahara Mahara 15.10.2
7.5
CVSSv2
CVE-2017-1000154
Mahara 15.04 prior to 15.04.8 and 15.10 prior to 15.10.4 and 16.04 prior to 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in login form, still allowing users to log in even if their institution was expired or suspended.
Mahara Mahara 15.04.1Mahara Mahara 15.04.3Mahara Mahara 15.04Mahara Mahara 15.04.4Mahara Mahara 15.04.5Mahara Mahara 15.04.6Mahara Mahara 15.04.7Mahara Mahara 15.04.0Mahara Mahara 15.04.2Mahara Mahara 16.04Mahara Mahara 16.04.1Mahara Mahara 16.04.0Mahara Mahara 15.10.3Mahara Mahara 15.10.0Mahara Mahara 15.10.1Mahara Mahara 15.10.2
3.5
CVSSv2
CVE-2017-1000146
Mahara 1.9 prior to 1.9.7 and 1.10 prior to 1.10.5 and 15.04 prior to 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in user because the title of the portfolio page was not being properly escaped in the AJAX script that updates the Add/...
Mahara Mahara 1.9.5Mahara Mahara 1.9.6Mahara Mahara 1.9.1Mahara Mahara 1.9.2Mahara Mahara 1.9.3Mahara Mahara 1.9.0Mahara Mahara 1.9.4Mahara Mahara 1.9Mahara Mahara 1.10.2Mahara Mahara 1.10.3Mahara Mahara 1.10.4Mahara Mahara 1.10Mahara Mahara 1.10.1Mahara Mahara 1.10.0Mahara Mahara 15.04Mahara Mahara 15.04.0Mahara Mahara 15.04.1
4
CVSSv2
CVE-2017-1000145
Mahara 1.9 prior to 1.9.7 and 1.10 prior to 1.10.5 and 15.04 prior to 15.04.2 are vulnerable to anonymous comments being able to be placed on artefact detail pages even when the site administrator had disallowed anonymous comments.
Mahara Mahara 1.9.0Mahara Mahara 1.9Mahara Mahara 1.9.6Mahara Mahara 1.9.2Mahara Mahara 1.9.4Mahara Mahara 1.9.5Mahara Mahara 1.9.1Mahara Mahara 1.9.3Mahara Mahara 1.10.1Mahara Mahara 1.10.3Mahara Mahara 1.10Mahara Mahara 1.10.0Mahara Mahara 1.10.2Mahara Mahara 1.10.4Mahara Mahara 15.04Mahara Mahara 15.04.0Mahara Mahara 15.04.1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
encryptionCVE-2024-4331CVE-2024-26925arbitrary codeCVE-2006-4304CVE-2024-25458CVE-2024-27077reflected XSSCVE-2024-4059
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook