CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-42049
https://notcve.org/view.php?id=CVE-2021-42049
06 Oct 2021 — An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information (such as PII). This allows oversighters to whitewash revisions. Se ha detectado un problema en la extensión Translate de MediaWiki a partir de la versión 1.36.2. Los supervisores no pueden deshacer las revisiones o la supervisión de las páginas en las que han suprimido información (como PII). • https://gerrit.wikimedia.org/r/q/I4d95220ef414337147235f7ebedc9b945c3348e3 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-42040
https://notcve.org/view.php?id=CVE-2021-42040
06 Oct 2021 — An issue was discovered in MediaWiki through 1.36.2. A parser function related to loop control allowed for an infinite loop (and php-fpm hang) within the Loops extension because egLoopsCountLimit is mishandled. This could lead to memory exhaustion. Se ha detectado un problema en MediaWiki versiones hasta 1.36.2. Una función del analizador relacionada con el control de bucles permitía un bucle infinito (y un cuelgue de php-fpm) dentro de la extensión Loops porque egLoopsCountLimit es manejado inapropiadament... • https://gerrit.wikimedia.org/r/q/I0caf6f129f94612b5bcf406a171aa5ffedea1f80 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-42041
https://notcve.org/view.php?id=CVE-2021-42041
06 Oct 2021 — An issue was discovered in CentralAuth in MediaWiki through 1.36.2. The rightsnone MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the setchange log. Se ha detectado un problema en CentralAuth en MediaWiki versiones hasta 1.36.2. El mensaje rightsnone de MediaWiki no estaba siendo saneado correctamente y permitía una inyección y ejecución de HTML y JavaScript por medio del registro setchange • https://gerrit.wikimedia.org/r/q/I7aeaa6e4de5ccaa5eeb6bf4fb00c96b01d5fea35 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-42042
https://notcve.org/view.php?id=CVE-2021-42042
06 Oct 2021 — An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-invalid-title MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript. Se ha detectado un problema en SpecialEditGrowthConfig en la extensión GrowthExperiments en MediaWiki versiones hasta 1.36.2. El mensaje growthexperiments-edit-config-error-invalid-title de MediaWiki no estaba siendo saneado... • https://gerrit.wikimedia.org/r/q/Ibeb13d032ca044af53f6b2334e27b6b97b6f4e9f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-42043
https://notcve.org/view.php?id=CVE-2021-42043
06 Oct 2021 — An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2. The suggestion text (a parameter to mediasearch-did-you-mean) was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the intitle: search operator within the query. Se ha detectado un problema en la función Special:MediaSearch en la extensión MediaSearch en MediaWiki versiones hasta 1.36.2. El texto de la sugerencia (un parámetro de mediasearch-did-you-mean... • https://gerrit.wikimedia.org/r/q/If64eb5842237c92290d07ebc3fe14710d9de3fc2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-42044
https://notcve.org/view.php?id=CVE-2021-42044
06 Oct 2021 — An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline, growthexperiments-mentor-dashboard-mentee-overview-info-text, growthexperiments-mentor-dashboard-mentee-overview-info-legend-headline, and growthexperiments-mentor-dashboard-mentee-overview-active-ago MediaWiki messages were not bei... • https://gerrit.wikimedia.org/r/q/I858d55fb2eca9b50ac6ef5a6f2a7b2784f0fa0d6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-31556
https://notcve.org/view.php?id=CVE-2021-31556
12 Aug 2021 — An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key will fit in a MySQL blob. Se ha detectado un problema en la extensión Oauth para MediaWiki versiones hasta 1.35.2. El archivo MWOAuthConsumerSubmitControl.php no asegura que la longitud de una clave RSA encaje en un blob de MySQL. • https://gerrit.wikimedia.org/r/q/I13ff0350a9a0a3cd5ab3e1f82dd0d8d9c13cf9e9 • CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-36125
https://notcve.org/view.php?id=CVE-2021-36125
02 Jul 2021 — An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial of service attacks when a user's current username is beyond an arbitrary maximum configuration value (MaxNameChars). Se ha detectado un problema en la extensión CentralAuth en MediaWiki versiones hasta 1.36. La página Special:GlobalRenameRequest es vulnerable a bucles infinitos y a ataques de denegación de servicio cuando el nombre de usuario actual ... • https://gerrit.wikimedia.org/r/q/I97d8b3236b5abed8ba9a9c4d3ab5050c2e782c22 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-36126
https://notcve.org/view.php?id=CVE-2021-36126
02 Jul 2021 — An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but that English version could also be invalid on a wiki. This would result in a fatal error, and potentially fail to block or restrict a potentially nefarious user. Se ha detectado un problema en la extensión AbuseFilter en MediaWiki versiones hasta 1.36. Si el mensaje de MediaWiki:Abusefilter-... • https://gerrit.wikimedia.org/r/q/I9e9f44b7663e810de70fb9ac7f6760f83dd4895b •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-36127
https://notcve.org/view.php?id=CVE-2021-36127
02 Jul 2021 — An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppressed MediaWiki user, were different than for any other user, thus easily disclosing suppressed accounts (which are supposed to be completely hidden). Se ha detectado un problema en la extensión CentralAuth en MediaWiki versiones hasta 1.36. La página Special:GlobalUserRights proporcionaba resultados de búsqueda que, para un usuario suprimido de MediaWik... • https://gerrit.wikimedia.org/r/q/I4e4dbcad61e1d4f6fd8b038bf63d19c69081a8ec • CWE-922: Insecure Storage of Sensitive Information •