CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-40601
https://notcve.org/view.php?id=CVE-2024-40601
An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules. Se descubrió un problema en la extensión MediaWikiChat para MediaWiki hasta 1.42.1. Puede ocurrir CSRF en módulos API. • https://phabricator.wikimedia.org/T362588 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-40605
https://notcve.org/view.php?id=CVE-2024-40605
An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Se descubrió un problema en el aspecto Foreground de MediaWiki hasta la versión 1.42.1. Hay XSS almacenado a través de MediaWiki: entradas del menú de nivel superior de la barra lateral. • https://phabricator.wikimedia.org/T361452 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-40596
https://notcve.org/view.php?id=CVE-2024-40596
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. (TimelineService does not support properly suppressing.) Se descubrió un problema en la extensión CheckUser para MediaWiki hasta 1.42.1. La función Special:Investigate puede exponer información suprimida para eventos de registro. • https://phabricator.wikimedia.org/T326866 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-40602
https://notcve.org/view.php?id=CVE-2024-40602
An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Se descubrió un problema en el aspecto Tempo de MediaWiki hasta la versión 1.42.1. Hay XSS almacenado a través de MediaWiki: entradas del menú de nivel superior de la barra lateral. • https://phabricator.wikimedia.org/T361451 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1CVE-2024-23174
https://notcve.org/view.php?id=CVE-2024-23174
An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-filter-date-range-to, pagetriage-filter-date-range-from, pagetriage-filter-date-range-heading, pagetriage-filter-set-button, or pagetriage-filter-reset-button message. Se descubrió un problema en la extensión PageTriage en MediaWiki antes de 1.35.14, 1.36.x hasta 1.39.x antes de 1.39.6 y 1.40.x antes de 1.40.2. XSS puede ocurrir a través de rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-filter-date-range-to, pagetriage-filter-date-range-from, pagetriage-filter-date-range-heading, pagetriage-filter-set-button, o mensaje pagetriage-filter-reset-button. • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PageTriage/+/989177 https://phabricator.wikimedia.org/T347704 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •