CVSS: 7.5EPSS: 3%CPEs: 49EXPL: 1CVE-2015-2942 – Gentoo Linux Security Advisory 201510-05
https://notcve.org/view.php?id=CVE-2015-2942
13 Apr 2015 — MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937. MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2, cuando se utiliza HHVM, permite a atacantes remotos causar una denegación de servi... • http://www.openwall.com/lists/oss-security/2015/04/01/1 • CWE-399: Resource Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 1CVE-2015-2941 – Gentoo Linux Security Advisory 201510-05
https://notcve.org/view.php?id=CVE-2015-2941
13 Apr 2015 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value. Vulnerabilidad de XSS en MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2, cuando se utiliza HHVM, permite a atacantes remo... • http://www.openwall.com/lists/oss-security/2015/04/01/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 0CVE-2015-2933 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2933
13 Apr 2015 — Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant. Vulnerabilidad de XSS en la clase Html en MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9, y 1.24.x anterior a 1.24.2 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una cadena de sustituci... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 49EXPL: 0CVE-2015-2937 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2937
13 Apr 2015 — MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942. MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2, cuando se utiliza HHVM o Zend PHP, permite a atacantes remotos causar una d... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-399: Resource Management Errors •
CVSS: 8.2EPSS: 1%CPEs: 49EXPL: 1CVE-2015-2931 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2931
13 Apr 2015 — Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI. Vulnerabilidad de lista negra incompleta en includes/upload/UploadBase.php en MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9, y 1.24.x anterior a 1.24.2 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o H... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 0CVE-2015-2938 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2938
13 Apr 2015 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file. Vulnerabilidad de XSS en MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un fichero JavaScript personalizado, lo cual no ... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 49EXPL: 0CVE-2015-2934 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2934
13 Apr 2015 — MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file. MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9, y 1.24.x anterior a 1.24.2 no maneja correctamente cuando la función xml_parse del interprete de Zend no expande entidades, lo que permite a atacantes remotos inyectar secuencias de comandos web arb... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 49EXPL: 0CVE-2015-2935 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2935
13 Apr 2015 — MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT." MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2 permite a atacantes remotos evadir el filtrado de SVG y obtener información sensible de usuario a través del uso de minúsculas y mayúsculas en @import en un elemento style de un fic... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 49EXPL: 0CVE-2015-2932 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2932
13 Apr 2015 — Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element. Vulnerabilidad de lista negra incompleta en MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un elemento href XLink animado. In MediaWiki before 1.23.9, one could circumvent the ... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2014-9481 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-9481
09 Feb 2015 — The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML. La extensión Scribunto para MediaWiki, permite a atacantes remotos obtener el token de reversión y posiblemente otra información confidencial por medio de un módulo diseñado, relacionado con el desarmado de páginas HTML especiales. Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow ... • http://www.openwall.com/lists/oss-security/2014/12/21/2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •