CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-26121
https://notcve.org/view.php?id=CVE-2020-26121
27 Sep 2020 — An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an upload restriction and a create restriction. An attacker cannot leverage this to overwrite anything, but can leverage this to force a wiki to have a page with a disallowed title. Se detectó un problema en la extensión FileImpor... • https://commons.wikimedia.org/w/index.php?oldid=454609892#File:Wiki.png • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2020-26120
https://notcve.org/view.php?id=CVE-2020-26120
27 Sep 2020 — XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM. Una vulnerabilidad de tipo XSS se presenta en la extensión MobileFrontend para MediaWiki versiones anteriores a 1.34.4 porque section.line es manejada inapropiadamente du... • https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10ea • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15005 – Debian Security Advisory 4767-1
https://notcve.org/view.php?id=CVE-2020-15005
24 Jun 2020 — In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled. En MediaWiki en versiones anteriores a la 1.31.8, 1.32.x y 1.33.x versiones anteriores a la 1.33.4, y 1.34.x en versiones anteriores a la 1.34.2, los wikis privados que se enc... • https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_31/RELEASE-NOTES-1.31 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-10959
https://notcve.org/view.php?id=CVE-2020-10959
02 Jun 2020 — resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page. En el archivo resources/src/mediawiki.page.ready/ready.js en MediaWiki versiones anteriores a 1.35, permite a atacantes remotos forzar un cierre de sesión y una redirección externa por medio del contenido HTML en una página de MediaWiki. • https://gerrit.wikimedia.org/r/c/mediawiki/core/+/536725 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2020-10960 – Debian Security Advisory 4651-1
https://notcve.org/view.php?id=CVE-2020-10960
03 Apr 2020 — In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS). En MediaWiki versiones anteriores a 1.34.1, los usuarios pueden agregar varias clases de Cascad... • https://lists.wikimedia.org/pipermail/wikitech-l/2020-March/093243.html • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10534
https://notcve.org/view.php?id=CVE-2020-10534
12 Mar 2020 — In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining escalated privileges. This is related to the case in which an IP address is contained in two ranges, one of which is locally disabled. En la extensión GlobalBlocking antes del 10-03-2020, para MediaWiki versiones hasta la versión 1.34.0, un problema relacionado con la evaluación del rango IP resultó en que los usuarios bloqueados volvieran a obtener pri... • https://gerrit.wikimedia.org/r/#/q/I9cc5fb2c08c78bbd797a5fc6d89f4577c8cc118b • CWE-863: Incorrect Authorization •
CVSS: 9.3EPSS: 2%CPEs: 2EXPL: 0CVE-2012-4381
https://notcve.org/view.php?id=CVE-2012-4381
08 Feb 2020 — MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors. MediaWiki versiones anteriores a 1.18.5 y versiones 1.19.x anteriores a 1.19.2, guardan l... • http://osvdb.org/show/osvdb/85106 • CWE-798: Use of Hard-coded Credentials •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2013-6455
https://notcve.org/view.php?id=CVE-2013-6455
28 Jan 2020 — The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page. La extensión CentralAuth para MediaWiki versiones anteriores a 1.19.10, versiones 1.2x anteriores a 1.21.4 y versiones 1.22.x anteriores a 1.22.1, permite a atacantes remotos obtener nombres de usuario por medio de vectores relacionados con la escritura de los nombres en el DOM de una página. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 2CVE-2019-19709 – Debian Security Advisory 4592-1
https://notcve.org/view.php?id=CVE-2019-19709
11 Dec 2019 — MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page. MediaWiki versiones hasta 1.33.1, permite a atacantes omitir el mecanismo de protección Title_blacklist al iniciar con un título arbitrario, estableciendo un redireccionamiento no resoluble para la página asociada y usando redirect=1 en la API action cuan... • https://gerrit.wikimedia.org/r/q/Ie54f366986056c876eade0fcad6c41f70b8b8de8 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2012-0046
https://notcve.org/view.php?id=CVE-2012-0046
29 Oct 2019 — mediawiki allows deleted text to be exposed mediawiki, permite que el texto eliminado sea expuesto. • https://access.redhat.com/security/cve/cve-2012-0046 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •