Page 20 of 268 results (0.013 seconds)

CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 0

CVE-2015-8002

https://notcve.org/view.php?id=CVE-2015-8002

09 Nov 2015 — The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks. La API chunked upload (ApiUpload) en MediaWiki en MediaWiki en versiones anteriores a 1.23.11, 1.24.x en versiones anteriores a 1.24.4 y 1.25.x en versiones anteriores a 1.25.3 permite a usuarios remotos autenticados causar una denegación de servicio (consumo de disco) a través... • http://www.securitytracker.com/id/1034028 • CWE-399: Resource Management Errors •

CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2015-8004

https://notcve.org/view.php?id=CVE-2015-8004

09 Nov 2015 — MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form. MediaWiki en versiones anteriores a 1.23.11, 1.24.x en versiones anteriores a 1.24.4 y 1.25.x en versiones anteriores a 1.25.3 no restringe correctamente el acceso a las revisiones, lo que permite a usuarios re... • http://www.securitytracker.com/id/1034028 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2015-8005

https://notcve.org/view.php?id=CVE-2015-8005

09 Nov 2015 — MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file. MediaWiki en versiones anteriores a 1.23.11, 1.24.x en versiones anteriores a 1.24.4 y 1.25.x en versiones anteriores a 1.25.3 utiliza el argumento de línea de comando thumbnail ImageMagick, lo que permite atacantes remotos obtener la ruta de instalación leyendo los metadat... • http://www.securitytracker.com/id/1034028 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2015-8001

https://notcve.org/view.php?id=CVE-2015-8001

09 Nov 2015 — The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size. La API chunked upload (ApiUpload) en MediaWiki en versiones anteriores a 1.23.11, 1.24.x en versiones anteriores a 1.24.4 y 1.25.x en versiones anteriores a 1.25.3 no restringe los datos subidos al tamaño de archivo declarado, lo ... • http://www.securitytracker.com/id/1034028 • CWE-284: Improper Access Control •

CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0

CVE-2015-6727

https://notcve.org/view.php?id=CVE-2015-6727

01 Sep 2015 — The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text. Vulnerabilidad en la página Special:DeletedContributions en MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, permite a atacantes remotos determinar si una IP es autobloqueada a través del texto 'Change block'. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2013-7444

https://notcve.org/view.php?id=CVE-2013-7444

01 Sep 2015 — The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text. Vulnerabilidad en la página Special:Contributions en MediaWiki en versiones anteriores a 1.22.0, permite a atacantes remotos determinar si una IP es autobloqueada a través del texto 'Change block'. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2015-6728 – Gentoo Linux Security Advisory 201510-05

https://notcve.org/view.php?id=CVE-2015-6728

01 Sep 2015 — The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack. Vulnerabilidad en la función ApiBase::getWatchlistUser en MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, no realiza el token de comparación en tiempo constante, ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0

CVE-2015-6729 – Gentoo Linux Security Advisory 201510-05

https://notcve.org/view.php?id=CVE-2015-6729

01 Sep 2015 — Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page. Vulnerabilidad de XSS en thumb.php en MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0

CVE-2015-6730 – Gentoo Linux Security Advisory 201510-05

https://notcve.org/view.php?id=CVE-2015-6730

01 Sep 2015 — Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images." Vulnerabilidad de XSS en thumb.php en MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, permite a atacantes remotos inyectar secuencias de coman... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 4%CPEs: 6EXPL: 0

CVE-2015-6733 – Gentoo Linux Security Advisory 201510-05

https://notcve.org/view.php?id=CVE-2015-6733

01 Sep 2015 — GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors. Vulnerabilidad en GeSHi, como se usa en la extensión SyntaxHighligh_GeSHi y MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, permite a atacantes remotos causar una denegación de servicio (consumo de recur... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-399: Resource Management Errors •