Kristina Hoeppner

The issue allows embedded images to be accessible without a sufficient permission check under certain conditions.

The issue allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action.

The issue allows certain personal information to be discoverable by inspecting network responses on the 'Edit access' screen when sharing portfolios.

An issue allows unauthorized access to a user's account if the browser is closed without logging out of Mahara. The value in the `usr session` table remains, and an attacker can exploit this by adjusting the `mahara` cookie to the old value, thus gaining access to the user's account.