Mahara 1.7.6

CPE Details

Mahara 1.7.6
mahara
mahara
1.7.6
2014-05-19
16h15 +00:00
2014-05-19
16h25 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:mahara:mahara:1.7.6:*:*:*:*:*:*:*

Informations

Vendor

mahara

Product

mahara

Version

1.7.6

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-29585 2022-04-28 13h29 +00:00 In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list (rather than only being shown for the institution that the viewer is a member of).
7.5
High
CVE-2022-29584 2022-04-28 13h26 +00:00 Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action.
5.4
Medium
CVE-2022-28892 2022-04-27 22h00 +00:00 Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessable.
8.8
High
CVE-2021-40849 2021-11-03 09h14 +00:00 In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.
9.8
Critical
CVE-2021-40848 2021-11-03 09h11 +00:00 In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection.
7.8
High
CVE-2017-1000141 2018-01-30 18h00 +00:00 An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address.
6.5
Medium