CVSS: 8.1EPSS: 0%CPEs: 50EXPL: 1CVE-2014-5241 – Debian Security Advisory 3011-1
https://notcve.org/view.php?id=CVE-2014-5241
22 Aug 2014 — The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with a restricted character set. El endpoint JSONP en includes/api/ApiFormatJson.php en MediaWi... • http://advisories.mageia.org/MGASA-2014-0309.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 1CVE-2014-5242 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-5242
22 Aug 2014 — Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value. Vulnerabilidad de XSS en mediawiki.page.image.pagination.js en MediaWiki 1.22.x anterior a 1.22.9 y 1.23.x anterior a 1.23.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través ... • http://advisories.mageia.org/MGASA-2014-0309.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 50EXPL: 1CVE-2014-5243 – Debian Security Advisory 3011-1
https://notcve.org/view.php?id=CVE-2014-5243
22 Aug 2014 — MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site. MediaWiki anterior a 1.19.18, 1.20.x hasta 1.22.x anterior a 1.22.9, y 1.23.x anterior a 1.23.2 no aplica un mecanismo de protección IFRAME para páginas transcluidas, lo que facilita a atacantes remotos realizar ataques de clickjacking a través de un sit... • http://advisories.mageia.org/MGASA-2014-0309.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 33EXPL: 0CVE-2014-3966 – Debian Security Advisory 2957-1
https://notcve.org/view.php?id=CVE-2014-3966
06 Jun 2014 — Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username. Vulnerabilidad de XSS en Special:PasswordReset in MediaWiki anterior a 1.19.16, 1.21.x anterior a 1.21.10 y 1.22.x anterior a 1.22.7, cuando wgRawHtml está habilitado, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a ... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-May/000151.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 193EXPL: 0CVE-2014-2853 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-2853
29 Apr 2014 — Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. Vulnerabilidad de XSS en includes/actions/InfoAction.php en MediaWiki anterior a 1.21.9 y 1.22.x anterior a 1.22.6 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de la clave "sort" en una acción "info". Multiple vulnerabilities have been found in MediaWiki... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-April/000149.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 39EXPL: 0CVE-2014-2665 – Debian Security Advisory 2891-3
https://notcve.org/view.php?id=CVE-2014-2665
07 Apr 2014 — includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue. El archivo includes/specials/SpecialChangePassword.php en MediaWiki a... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000145.html • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 0%CPEs: 90EXPL: 0CVE-2014-2242 – Mandriva Linux Security Advisory 2014-057
https://notcve.org/view.php?id=CVE-2014-2242
02 Mar 2014 — includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element. includes/upload/UploadBase.php en MediaWiki anterior a 1.19.12, 1.20.x y 1.21.x anterior a 1.21.6 y 1.22.x anterior a 1.22.3 no previene el uso de espacios... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 90EXPL: 0CVE-2014-2243 – Mandriva Linux Security Advisory 2014-057
https://notcve.org/view.php?id=CVE-2014-2243
02 Mar 2014 — includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses. includes/User.php en MediaWiki anterior a 1.19.12, 1.20.x y 1.21.x anterior a 1.21.6 y 1.22.x anterior a 1.22.3 termina la validación de un token de usuario cua... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.1EPSS: 0%CPEs: 90EXPL: 0CVE-2014-2244 – Mandriva Linux Security Advisory 2014-057
https://notcve.org/view.php?id=CVE-2014-2244
02 Mar 2014 — Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php. Vulnerabilidad de XSS en la función formatHTML en includes/api/ApiFormatBase.php en MediaWiki anterior a 1.19.12, 1.20.x y 1.21.x anterior a 1.21.6 y 1.22.x anterior a 1.22.3 permite ... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 136EXPL: 0CVE-2011-0047
https://notcve.org/view.php?id=CVE-2011-0047
04 Feb 2011 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) comments, aka "CSS injection vulnerability." Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en MediaWiki anterior a v1.16.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML mediante una hoja de estilos (CSS) manipulada, también conocido como "vulnerabilidad de inyección de... • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •