ME
Product
Mediawiki
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 63Medium 198Low 3
Watch
Add Mediawiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-2936 | – | Apr 13 | MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password Affected: 1.24.0; 1.24.1 |
| CVE-2015-2935 | – | Apr 13 | MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case… Affected: through 1.19.23; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2015-2934 | – | Apr 13 | MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows… Affected: through 1.19.23; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2015-2933 | – | Apr 13 | Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary… Affected: through 1.19.23; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2015-2932 | – | Apr 13 | Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an… Affected: through 1.19.23; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2015-2931 | – | Apr 13 | Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject… Affected: through 1.19.23; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-9480 | – | Jan 16 | Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text… Affected: through 1.19.22; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-9479 | – | Jan 16 | Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text… Affected: through 1.19.22; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-9478 | – | Jan 16 | Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary… Affected: through 1.19.22; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-9477 | – | Jan 16 | Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2)… Affected: through 1.19.22; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-9476 | – | Jan 16 | MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has… Affected: through 1.19.22; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-9475 | – | Jan 16 | Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated… Affected: through 1.19.22; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-9507 | – | Jan 4 | MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks by… Affected: through 1.19.21; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-9277 | – | Jan 4 | The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to… Affected: through 1.19.21; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-9276 | – | Jan 4 | Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7,… Affected: through 1.19.21; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2014-7295 | – | Oct 7 | The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to… Affected: through 1.19.19; 1.19; 1.19; 1.19; 1.19.0; 1.19.1; +34 more |
| CVE-2014-7199 | – | Sep 30 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or… Affected: 1.19; 1.19; 1.19; 1.19.0; 1.19.1; 1.19.2; +31 more |
| CVE-2014-5243 | – | Aug 22 | MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it… Affected: through 1.19.17; 1.19; 1.19; 1.19; 1.19.0; 1.19.1; +34 more |
| CVE-2014-5242 | – | Aug 22 | Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject… Affected: 1.22.0; 1.22.1; 1.22.2; 1.22.3; 1.22.4; 1.22.5; +5 more |
| CVE-2014-5241 | – | Aug 22 | The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback… Affected: through 1.19.17; 1.19; 1.19; 1.19; 1.19.0; 1.19.1; +34 more |
| CVE-2014-3966 | – | Jun 6 | Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows… Affected: through 1.19.15; 1.19.0; 1.19.1; 1.19.2; 1.19.3; 1.19.4; +27 more |
| CVE-2013-1818 | – | Jun 2 | maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors Affected: through 1.20.2; 1.20; 1.20.1 |
| CVE-2012-5395 | – | Jun 2 | Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web… Affected: 1.20; 1.19; 1.19; 1.19; 1.19.1; 1.19.2; +9 more |
| CVE-2012-5391 | – | Jun 2 | Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via… Affected: through 1.18.5; 1.18; 1.18; 1.18.0; 1.18.0; 1.18.1; +9 more |
| CVE-2014-3455 | – | May 12 | Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4) CreateClass special pages in the SemanticForms… Affected: 1.22.0; through 1.19.9; 1.19; 1.19; 1.19; 1.19.0; +12 more |
| CVE-2014-3454 | – | May 12 | Cross-site request forgery (CSRF) vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1… Affected: 1.22.0; 1.21; 1.21.1; 1.21.2; 1.21.3; through 1.19.9; +12 more |
| CVE-2013-6472 | – | May 12 | MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced… Affected: 1.22.0; through 1.19.9; 1.19; 1.19; 1.19; 1.19.0; +12 more |
| CVE-2013-6454 | – | May 12 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML… Affected: 1.21; 1.21.1; 1.21.2; 1.21.3; 1.22.0; through 1.19.9; +12 more |
| CVE-2013-6453 | – | May 12 | MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid… Affected: 1.22.0; 1.21; 1.21.1; 1.21.2; 1.21.3; through 1.19.9; +12 more |
| CVE-2013-6452 | – | May 12 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML… Affected: 1.22.0; 1.21; 1.21.1; 1.21.2; 1.21.3; through 1.19.9; +12 more |
| CVE-2013-4574 | – | May 12 | Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to… Affected: through 1.19.9; 1.19; 1.19; 1.19; 1.19.0; 1.19.1; +12 more |
| CVE-2013-4571 | – | May 12 | Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors Affected: 1.22.0; 1.21; 1.21.1; 1.21.2; 1.21.3; through 1.19.9; +12 more |
| CVE-2013-4570 | – | May 12 | The zend_inline_hash_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers… Affected: 1.22.0; through 1.19.9; 1.19; 1.19; 1.19; 1.19.0; +12 more |
| CVE-2014-2853 | – | Apr 29 | Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web… Affected: through 1.21.8; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2014-2665 | – | Apr 20 | includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly… Affected: through 1.19.13; 1.19; 1.19; 1.19; 1.19.0; 1.19.1; +33 more |
| CVE-2014-2244 | – | Mar 2 | Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x… Affected: through 1.19.11; 1.1.0; 1.10.0; 1.10.0; 1.10.0; 1.10.1; +34 more |
| CVE-2014-2243 | – | Mar 2 | includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first… Affected: through 1.19.11; 1.1.0; 1.10.0; 1.10.0; 1.10.0; 1.10.1; +34 more |
| CVE-2014-2242 | – | Mar 2 | includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files,… Affected: through 1.19.11; 1.1.0; 1.10.0; 1.10.0; 1.10.0; 1.10.1; +34 more |
| CVE-2014-1610 | – | Jan 30 | MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary… Affected: 1.19.0; 1.19.1; 1.19.2; 1.19.3; 1.19.4; 1.19.5; +11 more |
| CVE-2013-4304 | – | Jan 26 | The CentralAuth extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 caches a valid CentralAuthUser object in the centralauth_User cookie… Affected: 1.19; 1.19; 1.19; 1.19.0; 1.19.1; 1.19.2; +14 more |
| CVE-2013-4569 | – | Dec 13 | The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recent changes and watchlist" is enabled,… Affected: 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; 1.20.5; +17 more |
| CVE-2013-4568 | – | Dec 13 | Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site… Affected: 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; 1.20.5; +17 more |
| CVE-2013-4567 | – | Dec 13 | Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site… Affected: through 1.19.8; 1.19; 1.19; 1.19; 1.19.0; 1.19.1; +17 more |
| CVE-2012-5394 | – | Dec 13 | Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to… Affected: 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; 1.20.5; +17 more |
| CVE-2013-4573 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote… Affected: 1.19.0; 1.19.1; 1.19.2; 1.19.3; 1.19.4; 1.19.5; +14 more |
| CVE-2013-2114 | – | Nov 18 | Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by… Affected: 1.19; 1.19; 1.19; 1.19.0; 1.19.1; 1.19.2; +9 more |
| CVE-2013-2032 | – | Nov 18 | MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which… Affected: through 1.19.5; 1.1.0; 1.10.0; 1.10.0; 1.10.0; 1.10.1; +34 more |
| CVE-2013-2031 | – | Nov 18 | MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7… Affected: through 1.19.5; 1.1.0; 1.10.0; 1.10.0; 1.10.0; 1.10.1; +34 more |
| CVE-2013-4302 | – | Oct 27 | (1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki… Affected: 1.19.0; 1.19.1; 1.19.2; 1.19.3; 1.19.4; 1.19.5; +11 more |
| CVE-2013-4301 | – | Oct 27 | includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive… Affected: 1.19.0; 1.19.1; 1.19.2; 1.19.3; 1.19.4; 1.19.5; +11 more |