ME
Product
Mediawiki
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 63Medium 198Low 3
Watch
Add Mediawiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-12472 | 7.5 | Jul 10 | An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1 Affected: 1.18.0 before 1.27.6; 1.30.0 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |
| CVE-2015-8008 | 7.5 | Dec 29 | The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access… Affected: before 1.25.3 |
| CVE-2017-8815 | 7.5 | Nov 15 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2017-8814 | 7.5 | Nov 15 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a… Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2017-8810 | 7.5 | Nov 15 | MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending… Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2012-4380 | 7.5 | Oct 19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors Affected: through 1.18.4; 1.19.0; 1.19.1 |
| CVE-2016-6337 | 7.5 | Apr 20 | MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after… Affected: 1.27.0 |
| CVE-2016-6335 | 7.5 | Apr 20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain… Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more |
| CVE-2016-6332 | 7.5 | Apr 20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by… Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more |
| CVE-2016-6331 | 7.5 | Apr 20 | ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to… Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more |
| CVE-2015-8625 | 7.5 | Mar 23 | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows… Affected: through 1.23.11; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; +5 more |
| CVE-2024-34507 | 7.4 | May 5 | An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1 Affected: before 1.39.7; 1.40.0 before 1.40.3; 1.41.0 before 1.41.1 |
| CVE-2023-3550 | 7.3 | Sep 25 | Mediawiki v1.40.0 does not validate namespaces used in XML files Affected: 1.40.0 |