Researchers
Back
Mike Haworth
#18683
of 60,574
16.7
Total CVSS
Vulnerabilities
·
3
Medium
3
PT-2012-3898
2012-11-24
6.4
CVE-2012-2239
Catalyst It
Mahara
The issue allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack. This can be demonstrated by reading the config.php file.
PT-2012-3902
2012-11-24
4.3
CVE-2012-2243
Catalyst It
Mahara
A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by uploading an XML file with the xhtml extension, which is rendered inline as script.
PT-2012-3903
2012-11-24
6.0
CVE-2012-2244
Catalyst It
Mahara
The issue allows remote authenticated administrators to execute arbitrary programs by modifying the path to `clamav`. It can also be exploited without authentication by leveraging another vulnerability.