CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-0503 – $wgRateLimits entry for 'user' overrides 'newbie'
https://notcve.org/view.php?id=CVE-2018-0503
24 Sep 2018 — Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'. Mediawiki en versiones 1.31 anteriores a la 1.31.1, 1.30.1, 1.29.3 y 1.27.5 contiene un fallo en el que, contrario a lo que pone en su documentación, la entrada $wgRateLimits para "user" sobrescribe la de "newbie". Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premi... • http://www.securitytracker.com/id/1041695 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 1CVE-2018-0505 – BotPasswords can bypass CentralAuth's account lock
https://notcve.org/view.php?id=CVE-2018-0505
24 Sep 2018 — Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock Mediawiki en versiones 1.31 anteriores a la 1.31.1, 1.30.1, 1.29.3 y 1.27.5 contiene un fallo en el que BotPasswords puede omitir el bloqueo de cuenta de CentratlAuth. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains an updated mediawiki RPM packag... • http://www.securitytracker.com/id/1041695 • CWE-285: Improper Authorization CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-0504 – Information disclosure in Special:Redirect/logid
https://notcve.org/view.php?id=CVE-2018-0504
24 Sep 2018 — Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid Mediawiki en versiones 1.31 anteriores a la 1.31.1, 1.30.1, 1.29.3 y 1.27.5 contiene un fallo de divulgación de información en Special:Redirect/logid. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the mediawiki123 RPM package for Red Hat OpenShift ... • http://www.securitytracker.com/id/1041695 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-0361 – api.log contains passwords in plaintext
https://notcve.org/view.php?id=CVE-2017-0361
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext. Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error de divulgación de información en el que api.log podría contener contraseñas en texto plano. • http://www.securitytracker.com/id/1039812 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-0362 – "Mark all pages visited" on the watchlist does not require a CSRF token
https://notcve.org/view.php?id=CVE-2017-0362
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token. Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error por el cual "Mark all pages visited" en la lista de control no requiere un token CSRF • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-0363 – Special:UserLogin?returnto=interwiki:foo will redirect to external sites
https://notcve.org/view.php?id=CVE-2017-0363
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites. Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error por el cual Special:UserLogin?returnto=interwiki:foo redirigirá a sitios externos. • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-0364 – Special:Search allows redirects to any interwiki link
https://notcve.org/view.php?id=CVE-2017-0364
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link. Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error por el cual Special:Search permite la redirección a cualquier enlace de interwiki. • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.7EPSS: 0%CPEs: 4EXPL: 0CVE-2017-0365 – XSS in SearchHighlighter::highlightText() [requires non-default config]
https://notcve.org/view.php?id=CVE-2017-0365
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations. Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene una vulnerabilidad de Cross-Site Scripting (XSS) en SearchHighlighter::highlightText() con configuraciones que no son por defecto. • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 1CVE-2017-0366 – SVG filter evasion using default attribute values in DTD declaration
https://notcve.org/view.php?id=CVE-2017-0366
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration. Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error que permite la omisión del filtro SVG mediante el uso de valores de atributo por defecto en una declaración DTD. • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-0367 – Having LocalisationCache directory default to system tmp directory is insecure
https://notcve.org/view.php?id=CVE-2017-0367
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure. Mediawiki, en versiones anteriores a la 1.28.1 y la 1.27.2, contiene un uso inseguro de un directorio temporal, en el que tener por defecto el directorio LocalisationCache en el directorio system tmp no es seguro. • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-668: Exposure of Resource to Wrong Sphere •