CVE-2009-0660

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0 before 1.0.10 and 1.1 before 1.1.2 allow remote attackers to inject arbitrary web script or HTML via a (1) profile and (2) blog, a different vulnerability than CVE-2009-0487.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://mahara.org/interaction/forum/topic.php?id=350Vendor Advisory
http://secunia.com/advisories/34222Vendor Advisory
http://secunia.com/advisories/34231Vendor Advisory
http://wiki.mahara.org/Release_Notes/1.1.2
http://www.debian.org/security/2009/dsa-1736
http://www.securityfocus.com/bid/34064Exploit, Patch
http://www.vupen.com/english/advisories/2009/0665
https://exchange.xforce.ibmcloud.com/vulnerabilities/49168
http://mahara.org/interaction/forum/topic.php?id=350Vendor Advisory
http://secunia.com/advisories/34222Vendor Advisory
http://secunia.com/advisories/34231Vendor Advisory
http://wiki.mahara.org/Release_Notes/1.1.2
http://www.debian.org/security/2009/dsa-1736
http://www.securityfocus.com/bid/34064Exploit, Patch
http://www.vupen.com/english/advisories/2009/0665
https://exchange.xforce.ibmcloud.com/vulnerabilities/49168

Timeline

Published: Mar 11, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-06615.0Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command co CVE-2009-06626.0The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remot CVE-2009-06637.5Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to exe CVE-2009-06644.3Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0.x before 1.0.11 and 1.1.x before 1.1.3 allow remote attackers to inject ar CVE-2009-06677.2Untrusted search path vulnerability in Agent/Backend.pm in Ocsinventory-Agent before 0.0.9.3, and 1.x before 1.0.1, in OCS Inventory allows CVE-2009-06686.5Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enable CVE-2009-06697.5Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to CVE-2009-06726.5SQL injection vulnerability in the Resend_Email module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to ex CVE-2009-06736.5Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote auth CVE-2009-06746.0images/captcha.php in Raven Web Services RavenNuke 2.30, when register_globals and display_errors are enabled, allows remote attackers to de CVE-2009-06752.1The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFP_CLR_STATS requests only when the CAP_N CVE-2009-06762.1The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which al