Mahara 1.10 Release Candidate 1
Approved changes feed: RSS · Atom
cpe:2.3:a:mahara:mahara:1.10:rc1:*:*:*:*:*:*
part: a version: 1.10 update: rc1
| Vendor | Mahara (07d8f057-c7ff-5103-941c-641bef17cee0) |
|---|---|
| Product | Mahara (e34a4551-28da-5ed2-b032-aa35dad26cc2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/maharaproject/mahara |
purl2cpe | 2026-06-01 10:17:27.260383 |
pkg:mahara/mahara/mahara |
purl2cpe | 2026-06-01 10:17:27.260384 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-1000149 |
vulnerable | 2026-06-08 05:08:34.162258 |
Details available
Mahara 1.10 before 1.10.9 and 15.04 before 15.04.6 and 15.10 before 15.10.2 are vulnerable to XSS due to window.opener (target="_blank" and window.open())
Published: 2017-11-03T18:00:00.000Z
Updated: 2024-08-05T21:53:07.280Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000147 |
vulnerable | 2026-06-08 05:08:34.156361 |
Details available
Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into their Mahara account.
Published: 2017-11-03T18:00:00.000Z
Updated: 2024-08-05T21:53:07.096Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000146 |
vulnerable | 2026-06-08 05:08:34.152187 |
Details available
Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in user because the title of the portfolio page was not being properly escaped in the AJAX script that updates the Add/remove watchlist link on artefact detail pages.
Published: 2017-11-03T18:00:00.000Z
Updated: 2024-08-05T21:53:07.178Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000145 |
vulnerable | 2026-06-08 05:08:34.150373 |
Details available
Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to anonymous comments being able to be placed on artefact detail pages even when the site administrator had disallowed anonymous comments.
Published: 2017-11-03T18:00:00.000Z
Updated: 2024-08-05T21:53:07.086Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000144 |
vulnerable | 2026-06-08 05:08:34.146940 |
Details available
Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages.
Published: 2017-11-03T18:00:00.000Z
Updated: 2024-08-05T21:53:07.074Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000143 |
vulnerable | 2026-06-08 05:08:34.141571 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000142 |
vulnerable | 2026-06-08 05:08:34.140812 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000140 |
vulnerable | 2026-06-08 05:08:34.118633 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000139 |
vulnerable | 2026-06-08 05:08:34.117881 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000138 |
vulnerable | 2026-06-08 05:08:34.117210 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000137 |
vulnerable | 2026-06-08 05:08:34.116874 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000136 |
vulnerable | 2026-06-08 05:08:34.116514 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000135 |
vulnerable | 2026-06-08 05:08:34.115744 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000134 |
vulnerable | 2026-06-08 05:08:34.115032 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000132 |
vulnerable | 2026-06-08 05:08:34.112215 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.