CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2015-6728 – Gentoo Linux Security Advisory 201510-05
https://notcve.org/view.php?id=CVE-2015-6728
01 Sep 2015 — The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack. Vulnerabilidad en la función ApiBase::getWatchlistUser en MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, no realiza el token de comparación en tiempo constante, ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2015-6729 – Gentoo Linux Security Advisory 201510-05
https://notcve.org/view.php?id=CVE-2015-6729
01 Sep 2015 — Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page. Vulnerabilidad de XSS en thumb.php en MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2015-6730 – Gentoo Linux Security Advisory 201510-05
https://notcve.org/view.php?id=CVE-2015-6730
01 Sep 2015 — Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images." Vulnerabilidad de XSS en thumb.php en MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, permite a atacantes remotos inyectar secuencias de coman... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 6EXPL: 0CVE-2015-6733 – Gentoo Linux Security Advisory 201510-05
https://notcve.org/view.php?id=CVE-2015-6733
01 Sep 2015 — GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors. Vulnerabilidad en GeSHi, como se usa en la extensión SyntaxHighligh_GeSHi y MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, permite a atacantes remotos causar una denegación de servicio (consumo de recur... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-399: Resource Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2015-6734 – Gentoo Linux Security Advisory 201510-05
https://notcve.org/view.php?id=CVE-2015-6734
01 Sep 2015 — Cross-site scripting (XSS) vulnerability in contrib/cssgen.php in the GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en contrib/cssgen.php en GeSHi, como se usa en la extensión SyntaxHighligh_GeSHi y MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 3%CPEs: 49EXPL: 1CVE-2015-2942 – Gentoo Linux Security Advisory 201510-05
https://notcve.org/view.php?id=CVE-2015-2942
13 Apr 2015 — MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937. MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2, cuando se utiliza HHVM, permite a atacantes remotos causar una denegación de servi... • http://www.openwall.com/lists/oss-security/2015/04/01/1 • CWE-399: Resource Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 1CVE-2015-2941 – Gentoo Linux Security Advisory 201510-05
https://notcve.org/view.php?id=CVE-2015-2941
13 Apr 2015 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value. Vulnerabilidad de XSS en MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2, cuando se utiliza HHVM, permite a atacantes remo... • http://www.openwall.com/lists/oss-security/2015/04/01/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 0CVE-2015-2933 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2933
13 Apr 2015 — Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant. Vulnerabilidad de XSS en la clase Html en MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9, y 1.24.x anterior a 1.24.2 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una cadena de sustituci... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 49EXPL: 0CVE-2015-2937 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2937
13 Apr 2015 — MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942. MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2, cuando se utiliza HHVM o Zend PHP, permite a atacantes remotos causar una d... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-399: Resource Management Errors •
CVSS: 8.2EPSS: 1%CPEs: 49EXPL: 1CVE-2015-2931 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2931
13 Apr 2015 — Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI. Vulnerabilidad de lista negra incompleta en includes/upload/UploadBase.php en MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9, y 1.24.x anterior a 1.24.2 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o H... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •