ALT-PU-2014-1496-1
Closed vulnerabilities
Modified: 2023-02-13
CVE-2010-1150
MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue.
- [oss-security] 20100407 Re: CVE Request: MediaWiki 1.15.3 -- Login CSRF
- https://bugzilla.wikimedia.org/show_bug.cgi?id=23076
- [mediawiki-announce] 20100407 MediaWiki security update: 1.15.3 and 1.16.0beta2
- http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_0beta2/phase3/RELEASE-NOTES
- [oss-security] 20100406 CVE Request: MediaWiki 1.15.3 -- Login CSRF
- http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_15_3/phase3/RELEASE-NOTES
- http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0beta2.patch.gz
- http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.3.patch.gz
- https://bugzilla.redhat.com/show_bug.cgi?id=580418
- DSA-2041
- ADV-2010-1055
Modified: 2010-07-30
CVE-2010-1647
Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer.
Modified: 2010-07-30
CVE-2010-1648
Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form.
Modified: 2017-08-17
CVE-2011-0003
MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.
- [oss-security] 20110104 (possible) CVE request: Clickjacking in Mediawiki
- [oss-security] 20110104 Re: (possible) CVE request: Clickjacking in Mediawiki
- [MediaWiki-announce] 20110104 MediaWiki security release 1.16.1
- 70272
- https://bugzilla.wikimedia.org/show_bug.cgi?id=26561
- ADV-2011-0017
- 42810
- FEDORA-2011-5807
- FEDORA-2011-5812
- FEDORA-2011-5848
- mediawiki-frames-clickjacking(64476)
Modified: 2017-08-17
CVE-2011-0047
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) comments, aka "CSS injection vulnerability."
Modified: 2017-08-17
CVE-2011-1579
The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the \2f\2a and \2a\2f hex strings to surround CSS comments.
- https://bugzilla.redhat.com/show_bug.cgi?id=696360
- [oss-security] 20110413 Re: CVE request: mediawiki 1.16.3
- 47354
- ADV-2011-0978
- https://bugzilla.wikimedia.org/show_bug.cgi?id=28450
- [mediawiki-announce] 20110412 MediaWiki security release 1.16.3
- FEDORA-2011-5495
- http://www.mediawiki.org/wiki/Special:Code/MediaWiki/85856
- 44142
- https://bugzilla.redhat.com/show_bug.cgi?id=695577
- ADV-2011-1151
- ADV-2011-1100
- FEDORA-2011-5807
- FEDORA-2011-5812
- FEDORA-2011-5848
- DSA-2366
- mediawiki-css-data-xss(66738)
Modified: 2017-08-17
CVE-2011-1580
The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request.
- [mediawiki-announce] 20110412 MediaWiki security release 1.16.3
- https://bugzilla.wikimedia.org/show_bug.cgi?id=28449
- 44142
- https://bugzilla.redhat.com/show_bug.cgi?id=696360
- [oss-security] 20110413 Re: CVE request: mediawiki 1.16.3
- 47354
- https://bugzilla.redhat.com/show_bug.cgi?id=695577
- ADV-2011-0978
- FEDORA-2011-5495
- ADV-2011-1151
- ADV-2011-1100
- FEDORA-2011-5807
- FEDORA-2011-5812
- FEDORA-2011-5848
- DSA-2366
- mediawiki-transwiki-sec-bypass(66739)
Modified: 2011-06-16
CVE-2011-1766
includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.
Modified: 2021-04-21
CVE-2011-4360
MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.
- https://bugzilla.redhat.com/show_bug.cgi?id=758171
- [mediawiki-announce] 20111128 MediaWiki security release 1.17.1
- https://bugzilla.wikimedia.org/show_bug.cgi?id=32276
- [oss-security] 20111129 Re: CVE request: mediawiki before 1.17.1
- [oss-security] 20111129 CVE request: mediawiki before 1.17.1
- DSA-2366
Modified: 2021-04-21
CVE-2011-4361
MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.
- [oss-security] 20111129 CVE request: mediawiki before 1.17.1
- https://bugzilla.wikimedia.org/show_bug.cgi?id=32616
- [mediawiki-announce] 20111128 MediaWiki security release 1.17.1
- https://bugzilla.redhat.com/show_bug.cgi?id=758171
- [oss-security] 20111129 Re: CVE request: mediawiki before 1.17.1
- DSA-2366
Modified: 2019-10-31
CVE-2012-0046
mediawiki allows deleted text to be exposed
Modified: 2017-08-29
CVE-2012-2698
Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page.
- https://www.mediawiki.org/wiki/Release_notes/1.17
- [oss-security] 20120613 Re: CVE request: XSS in uselang http parameter (mediawiki)
- https://www.mediawiki.org/wiki/Release_notes/1.18
- [MediaWiki-announce] 20120613 MediaWiki security release 1.19.1
- https://www.mediawiki.org/wiki/Release_notes/1.19
- 49484
- https://bugzilla.wikimedia.org/show_bug.cgi?id=36938
- 82983
- https://gerrit.wikimedia.org/r/#/c/7979/1/includes/SkinTemplate.php
- 1027179
- [MediaWiki-announce] 20120613 MediaWiki security release 1.17.5
- [MediaWiki-announce] 20120613 MediaWiki security release 1.18.4
- mediawiki-index-uselang-xss(76311)
Modified: 2017-11-01
CVE-2012-4377
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.
- https://phabricator.wikimedia.org/T41700
- [MediaWiki-announce] 20120831 MediaWiki security release: 1.19.2 and 1.18.5
- https://bugzilla.redhat.com/show_bug.cgi?id=853409
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
- [oss-security] 20120831 CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
- [oss-security] 20120831 Re: CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
Modified: 2017-11-01
CVE-2012-4378
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.
- https://phabricator.wikimedia.org/T39587
- [MediaWiki-announce] 20120831 MediaWiki security release: 1.19.2 and 1.18.5
- https://bugzilla.redhat.com/show_bug.cgi?id=853417
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
- [oss-security] 20120831 CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
- [oss-security] 20120831 Re: CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
Modified: 2017-11-01
CVE-2012-4379
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.
- https://phabricator.wikimedia.org/T41180
- [MediaWiki-announce] 20120831 MediaWiki security release: 1.19.2 and 1.18.5
- https://bugzilla.redhat.com/show_bug.cgi?id=853426
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
- [oss-security] 20120831 CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
- [oss-security] 20120831 Re: CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
Modified: 2017-11-01
CVE-2012-4380
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
- https://phabricator.wikimedia.org/T41824
- [MediaWiki-announce] 20120831 MediaWiki security release: 1.19.2 and 1.18.5
- https://bugzilla.redhat.com/show_bug.cgi?id=853440
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
- [oss-security] 20120831 CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
- [oss-security] 20120831 Re: CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
Modified: 2020-02-12
CVE-2012-4381
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.
- http://www.openwall.com/lists/oss-security/2012/08/31/6
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
- https://bugzilla.redhat.com/show_bug.cgi?id=853442
- http://osvdb.org/show/osvdb/85106
- http://www.openwall.com/lists/oss-security/2012/08/31/10
- https://phabricator.wikimedia.org/T41184
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html
Modified: 2017-11-01
CVE-2012-4382
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt.
- https://phabricator.wikimedia.org/T41823
- [MediaWiki-announce] 20120831 MediaWiki security release: 1.19.2 and 1.18.5
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
- [oss-security] 20120831 CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
- [oss-security] 20120831 Re: CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws
Modified: 2017-08-29
CVE-2012-5391
Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id.
Modified: 2013-12-16
CVE-2012-5394
Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to hijack the authentication of users for requests that login via vectors involving image loading.
Modified: 2014-06-03
CVE-2012-5395
Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the centralauth_Session cookie.
Modified: 2024-11-21
CVE-2013-1816
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.
- http://security.gentoo.org/glsa/glsa-201310-21.xml
- http://security.gentoo.org/glsa/glsa-201310-21.xml
- http://www.openwall.com/lists/oss-security/2013/03/05/4
- http://www.openwall.com/lists/oss-security/2013/03/05/4
- 58306
- 58306
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1816
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1816
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88360
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88360
- https://security-tracker.debian.org/tracker/CVE-2013-1816
- https://security-tracker.debian.org/tracker/CVE-2013-1816
Modified: 2024-11-21
CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.
- http://security.gentoo.org/glsa/glsa-201310-21.xml
- http://security.gentoo.org/glsa/glsa-201310-21.xml
- http://www.openwall.com/lists/oss-security/2013/03/05/4
- http://www.openwall.com/lists/oss-security/2013/03/05/4
- http://www.securityfocus.com/bid/58305
- http://www.securityfocus.com/bid/58305
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1817
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1817
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88359
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88359
- https://security-tracker.debian.org/tracker/CVE-2013-1817
- https://security-tracker.debian.org/tracker/CVE-2013-1817
Modified: 2024-11-21
CVE-2013-1818
maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.
- http://www.mediawiki.org/wiki/Release_notes/1.20
- http://www.mediawiki.org/wiki/Release_notes/1.20
- 58304
- 58304
- https://bugzilla.wikimedia.org/show_bug.cgi?id=45355
- https://bugzilla.wikimedia.org/show_bug.cgi?id=45355
- mediawiki-cve20131818-info-disclosure(88363)
- mediawiki-cve20131818-info-disclosure(88363)
Modified: 2024-11-21
CVE-2013-2031
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.
- FEDORA-2013-7701
- FEDORA-2013-7701
- FEDORA-2013-7714
- FEDORA-2013-7714
- FEDORA-2013-7654
- FEDORA-2013-7654
- [MediaWiki-announce] 20130430 MediaWiki Security Release: 1.20.5 and 1.19.6
- [MediaWiki-announce] 20130430 MediaWiki Security Release: 1.20.5 and 1.19.6
- 55433
- 55433
- 57472
- 57472
- GLSA-201310-21
- GLSA-201310-21
- DSA-2891
- DSA-2891
- [oss-security] 20130501 Re: Mediawiki CVE request ( was Fw: [MediaWiki-announce] MediaWiki Security Release: 1.20.5 and 1.19.6)
- [oss-security] 20130501 Re: Mediawiki CVE request ( was Fw: [MediaWiki-announce] MediaWiki Security Release: 1.20.5 and 1.19.6)
- 59594
- 59594
- https://bugzilla.wikimedia.org/show_bug.cgi?id=47304
- https://bugzilla.wikimedia.org/show_bug.cgi?id=47304
Modified: 2024-11-21
CVE-2013-2032
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- FEDORA-2013-7701
- FEDORA-2013-7701
- FEDORA-2013-7714
- FEDORA-2013-7714
- FEDORA-2013-7654
- FEDORA-2013-7654
- [MediaWiki-announce] 20130430 MediaWiki Security Release: 1.20.5 and 1.19.6
- [MediaWiki-announce] 20130430 MediaWiki Security Release: 1.20.5 and 1.19.6
- 55433
- 55433
- GLSA-201310-21
- GLSA-201310-21
- https://bugzilla.wikimedia.org/show_bug.cgi?id=46590
- https://bugzilla.wikimedia.org/show_bug.cgi?id=46590
Modified: 2024-11-21
CVE-2013-4567
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS.
- FEDORA-2013-21874
- FEDORA-2013-21874
- FEDORA-2013-21856
- FEDORA-2013-21856
- [MediaWiki-announce] 20131114 MediaWiki Security Release: 1.21.3, 1.20.8 and 1.19.9
- [MediaWiki-announce] 20131114 MediaWiki Security Release: 1.21.3, 1.20.8 and 1.19.9
- 57472
- 57472
- DSA-2891
- DSA-2891
- 63760
- 63760
- https://bugzilla.wikimedia.org/show_bug.cgi?id=55332
- https://bugzilla.wikimedia.org/show_bug.cgi?id=55332
Modified: 2024-11-21
CVE-2013-4568
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
- FEDORA-2013-21874
- FEDORA-2013-21874
- FEDORA-2013-21856
- FEDORA-2013-21856
- [MediaWiki-announce] 20131114 MediaWiki Security Release: 1.21.3, 1.20.8 and 1.19.9
- [MediaWiki-announce] 20131114 MediaWiki Security Release: 1.21.3, 1.20.8 and 1.19.9
- 57472
- 57472
- DSA-2891
- DSA-2891
- 63761
- 63761
- https://bugzilla.wikimedia.org/attachment.cgi?id=13452&action=diff
- https://bugzilla.wikimedia.org/attachment.cgi?id=13452&action=diff
- https://bugzilla.wikimedia.org/show_bug.cgi?id=55332
- https://bugzilla.wikimedia.org/show_bug.cgi?id=55332
Modified: 2024-11-21
CVE-2013-4569
The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recent changes and watchlist" is enabled, allows remote attackers to obtain sensitive information (revision-deleted IPs) via the Recent Changes page.
- FEDORA-2013-21874
- FEDORA-2013-21874
- FEDORA-2013-21856
- FEDORA-2013-21856
- [MediaWiki-announce] 20131114 MediaWiki Security Release: 1.21.3, 1.20.8 and 1.19.9
- [MediaWiki-announce] 20131114 MediaWiki Security Release: 1.21.3, 1.20.8 and 1.19.9
- https://bugzilla.wikimedia.org/show_bug.cgi?id=54294
- https://bugzilla.wikimedia.org/show_bug.cgi?id=54294
Modified: 2024-11-21
CVE-2013-4570
The zend_inline_hash_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to converting Lua data structures to PHP, as demonstrated by passing { [{}] = 1 } to a module function.
Modified: 2024-11-21
CVE-2013-4571
Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors.
Modified: 2024-11-21
CVE-2013-4572
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
- https://bugzilla.wikimedia.org/show_bug.cgi?id=53032
- https://bugzilla.wikimedia.org/show_bug.cgi?id=53032
Modified: 2024-11-21
CVE-2013-4574
Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to videos.
Modified: 2024-11-21
CVE-2013-6452
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.
Modified: 2024-11-21
CVE-2013-6453
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.
Modified: 2024-11-21
CVE-2013-6454
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute.
Modified: 2024-11-21
CVE-2013-6455
The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.
Modified: 2024-11-21
CVE-2013-6472
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced RecentChanges, and (3) user watchlists.
Modified: 2024-11-21
CVE-2013-7444
The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
- FEDORA-2015-13920
- FEDORA-2015-13920
- [oss-security] 20150812 CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10
- [oss-security] 20150812 CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10
- [oss-security] 20150827 Re: CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10
- [oss-security] 20150827 Re: CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10
- https://github.com/wikimedia/mediawiki/commit/dc2966bd05b69321300c63fd0bd78e7c78ecea6e
- https://github.com/wikimedia/mediawiki/commit/dc2966bd05b69321300c63fd0bd78e7c78ecea6e
- [MediaWiki-announce] 20150810 MediaWiki Security and Maintenance Releases: 1.25.2, 1.24.3, 1.23.10
- [MediaWiki-announce] 20150810 MediaWiki Security and Maintenance Releases: 1.25.2, 1.24.3, 1.23.10
- https://phabricator.wikimedia.org/T48457
- https://phabricator.wikimedia.org/T48457
Modified: 2024-11-21
CVE-2014-2242
includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
- [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12
- [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12
- [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- 65910
- 65910
- https://bugzilla.redhat.com/show_bug.cgi?id=1071135
- https://bugzilla.redhat.com/show_bug.cgi?id=1071135
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60771
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60771
- https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb%2Cn%2Cz
- https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb%2Cn%2Cz
Modified: 2024-11-21
CVE-2014-2243
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.
- [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12
- [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12
- [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- https://bugzilla.redhat.com/show_bug.cgi?id=1071136
- https://bugzilla.redhat.com/show_bug.cgi?id=1071136
- https://bugzilla.wikimedia.org/show_bug.cgi?id=61346
- https://bugzilla.wikimedia.org/show_bug.cgi?id=61346
- https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f%2Cn%2Cz
- https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f%2Cn%2Cz
Modified: 2024-11-21
CVE-2014-2244
Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.
- [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12
- [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12
- [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release
- 65906
- 65906
- https://bugzilla.redhat.com/show_bug.cgi?id=1071139
- https://bugzilla.redhat.com/show_bug.cgi?id=1071139
- https://bugzilla.wikimedia.org/show_bug.cgi?id=61362
- https://bugzilla.wikimedia.org/show_bug.cgi?id=61362
- https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb%2Cn%2Cz
- https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb%2Cn%2Cz
Modified: 2024-11-21
CVE-2014-3454
Cross-site request forgery (CSRF) vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to hijack the authentication of users for requests that create categories via unspecified vectors.
Modified: 2024-11-21
CVE-2014-3455
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4) CreateClass special pages in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allow remote attackers to hijack the authentication of users for requests that have unspecified impact and vectors.
Closed bugs
Добавить зависимость на php5-dom
Некорректный mediawiki.ini