ME
Product
Mediawiki
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 63Medium 198Low 3
Watch
Add Mediawiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-4306 | – | Oct 11 | Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to… Affected: 1.19.0 before 1.19.8; 1.20.0 before 1.20.7; 1.21.0 before 1.21.2 |
| CVE-2013-4305 | – | Oct 11 | Cross-site scripting (XSS) vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded before September 2013, allows remote… Affected: 1.19.7; 1.20.6; 1.21.1 |
| CVE-2013-4307 | – | Sep 12 | Multiple cross-site scripting (XSS) vulnerabilities in repo/includes/EntityView.php in the Wikibase extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x… Affected: 1.19; 1.19; 1.19; 1.19.0; 1.19.1; 1.19.2; +14 more |
| CVE-2012-4885 | – | Sep 9 | The wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to cause a denial of service (infinite loop) via certain input, as… Affected: 1.17; 1.17; 1.17.0; 1.17.0; 1.17.1; 1.17.2; +5 more |
| CVE-2012-1582 | – | Sep 9 | Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script… Affected: 1.17; 1.17; 1.17.0; 1.17.0; 1.17.1; 1.17.2; +5 more |
| CVE-2012-1581 | – | Sep 9 | MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of… Affected: 1.17; 1.17; 1.17.0; 1.17.0; 1.17.1; 1.17.2; +5 more |
| CVE-2012-1580 | – | Sep 9 | Cross-site request forgery (CSRF) vulnerability in Special:Upload in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to hijack the authentication… Affected: 1.17; 1.17; 1.17.0; 1.17.0; 1.17.1; 1.17.2; +5 more |
| CVE-2012-1579 | – | Sep 9 | The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to… Affected: 1.17; 1.17; 1.17.0; 1.17.0; 1.17.1; 1.17.2; +5 more |
| CVE-2012-1578 | – | Sep 9 | Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users… Affected: 1.17; 1.17; 1.17.0; 1.17.0; 1.17.1; 1.17.2; +5 more |
| CVE-2012-2698 | – | Jun 29 | Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows… Affected: 1.18; 1.18; 1.18.0; 1.18.0; 1.18.1; 1.18.2; +34 more |
| CVE-2011-4361 | – | Jan 8 | MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging… Affected: before 1.17.1 |
| CVE-2011-4360 | – | Jan 8 | MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter Affected: before 1.17.1 |
| CVE-2011-1766 | – | May 23 | includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows… Affected: through 1.16.4; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2011-1765 | – | May 23 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML… Affected: through 1.16.4; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2011-1587 | – | Apr 27 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML… Affected: through 1.16.3; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2011-1580 | – | Apr 27 | The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any… Affected: through 1.16.2; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2011-1579 | – | Apr 27 | The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which… Affected: through 1.16.2; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2011-1578 | – | Apr 27 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML… Affected: through 1.16.2; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2010-2789 | – | Apr 27 | PHP remote file inclusion vulnerability in MediaWikiParserTest.php in MediaWiki 1.16 beta, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code… Affected: 1.16 |
| CVE-2010-2788 | – | Apr 27 | Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script… Affected: through 1.15.4; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2010-2787 | – | Apr 27 | api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain… Affected: through 1.15.4; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2011-0047 | – | Feb 4 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS)… Affected: through 1.16.1; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2011-0537 | – | Feb 4 | Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2, when running on… Affected: 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; 1.8.5; +34 more |
| CVE-2011-0003 | – | Jan 11 | MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors Affected: through 1.16.0; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2010-1648 | – | Jun 8 | Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the… Affected: 1.15.0; 1.15.0; 1.15.1; 1.15.2; 1.15.3; 1.16.0; +2 more |
| CVE-2010-1647 | – | Jun 8 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted… Affected: 1.15.0; 1.15.0; 1.15.1; 1.15.2; 1.15.3; 1.16.0; +2 more |
| CVE-2010-1150 | – | Apr 20 | MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote… Affected: through 1.15.2; 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +34 more |
| CVE-2010-1190 | – | Mar 31 | thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as img_auth.php, does not check user permissions before providing scaled images, which… Affected: through 1.15.1; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2010-1189 | – | Mar 31 | MediaWiki before 1.15.2 does not prevent wiki editors from linking to images from other web sites in wiki pages, which allows editors to obtain IP addresses and other information… Affected: through 1.15.1; 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +34 more |
| CVE-2009-4589 | – | Jan 7 | Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote… Affected: 1.14.0 |
| CVE-2009-0737 | – | Feb 25 | Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12 before 1.12.4, and 1.13 before 1.13.4, when… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +17 more |
| CVE-2008-5688 | – | Dec 19 | MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installation path in a debugging message, which… Affected: 1.8.1; 1.8.2; 1.8.3; 1.8.4; 1.8.5; 1.9.0; +27 more |
| CVE-2008-5687 | – | Dec 19 | MediaWiki 1.11, and other versions before 1.13.3, does not properly protect against the download of backups of deleted images, which might allow remote attackers to obtain… Affected: 1.11; 1.11; 1.11.1; 1.11.2; 1.12.0; 1.12.0; +8 more |
| CVE-2008-5252 | – | Dec 19 | Cross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1.13.x before 1.13.3 allows remote… Affected: 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; +34 more |
| CVE-2008-5250 | – | Dec 19 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an… Affected: 1.6.11; 1.12.0; 1.12.1; 1.13.0; 1.13.1; 1.13.2 |
| CVE-2008-5249 | – | Dec 19 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 1.13.0; 1.13.1; 1.13.2 |
| CVE-2008-4408 | – | Oct 3 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.1, 1.12.0, and possibly other versions before 1.13.2 allows remote attackers to inject arbitrary web script or HTML via… Affected: 1.12.0; 1.13.1 |
| CVE-2008-1318 | – | Mar 13 | Unspecified vulnerability in MediaWiki 1.11 before 1.11.2 allows remote attackers to obtain sensitive "cross-site" information via the callback parameter in an API call for… Affected: 1.11; 1.11.1 |
| CVE-2008-0460 | – | Jan 25 | Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for… Affected: 1.7.0; 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; +11 more |
| CVE-2007-4883 | – | Sep 14 | Cross-site scripting (XSS) vulnerability in the BotQuery extension in MediaWiki 1.7.x and earlier before SVN 20070910 allows remote attackers to inject arbitrary web script or… Affected: 1.7.0; 1.7.1; 1.7.2; 1.7.3 |
| CVE-2007-4828 | – | Sep 12 | Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development… Affected: 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; 1.9.0; +6 more |
| CVE-2007-1054 | – | Feb 21 | Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.6.x through 1.9.2, when $wgUseAjax is enabled, allows remote attackers to inject… Affected: through 1.8.2 |
| CVE-2007-1055 | – | Feb 21 | Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary… Affected: through 1.8.2; 1.9.0 |
| CVE-2007-0894 | – | Feb 12 | MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to (1) Simple.deps.php, (2) MonoBook.deps.php, (3) MySkin.deps.php, or (4)… Affected: 1.1.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; +34 more |
| CVE-2007-0788 | – | Feb 6 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.9.x before 1.9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to… Affected: 1.9.0; 1.9.1 |
| CVE-2007-0177 | – | Jan 11 | Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseAjax is enabled,… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +8 more |
| CVE-2006-2895 | – | Jun 7 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.6.0 up to versions before 1.6.7 allows remote attackers to inject arbitrary HTML and web script via the edit form Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +2 more |
| CVE-2006-2611 | – | May 26 | Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in the variable handler in MediaWiki 1.6.x before r14349 allows remote attackers to inject arbitrary Javascript… Affected: through 1.6.5_r14348; 1.6.5 |
| CVE-2006-1498 | – | Mar 30 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.5.8 and 1.4.15 allows remote attackers to inject arbitrary web script or HTML via crafted encoded links Affected: 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; 1.4.6; +25 more |
| CVE-2006-0322 | – | Jan 19 | Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite… Affected: 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; 1.4.6; +29 more |