Total vulnerabilities in the database
Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in user because the title of the portfolio page was not being properly escaped in the AJAX script that updates the Add/remove watchlist link on artefact detail pages.
| Software | From | Fixed in |
|---|---|---|
| mahara / mahara | 1.9.1 | 1.9.1.x |
| mahara / mahara | 1.9.2 | 1.9.2.x |
| mahara / mahara | 1.9.3 | 1.9.3.x |
| mahara / mahara | 1.9.0 | 1.9.0.x |
| mahara / mahara | 1.9-rc1 | 1.9-rc1.x |
| mahara / mahara | 1.9.4 | 1.9.4.x |
| mahara / mahara | 1.9.5 | 1.9.5.x |
| mahara / mahara | 1.9.6 | 1.9.6.x |
| mahara / mahara | 1.10.0 | 1.10.0.x |
| mahara / mahara | 1.10-rc1 | 1.10-rc1.x |
| mahara / mahara | 1.10.1 | 1.10.1.x |
| mahara / mahara | 1.10.2 | 1.10.2.x |
| mahara / mahara | 1.10.3 | 1.10.3.x |
| mahara / mahara | 1.10.4 | 1.10.4.x |
| mahara / mahara | 15.04-rc1 | 15.04-rc1.x |
| mahara / mahara | 15.04-rc2 | 15.04-rc2.x |
| mahara / mahara | 15.04.1 | 15.04.1.x |
| mahara / mahara | 15.04.0 | 15.04.0.x |