CVSS: 7.5EPSS: 1%CPEs: 49EXPL: 0CVE-2015-2937 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2937
13 Apr 2015 — MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942. MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2, cuando se utiliza HHVM o Zend PHP, permite a atacantes remotos causar una d... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-399: Resource Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 0CVE-2015-2938 – Mandriva Linux Security Advisory 2015-200
https://notcve.org/view.php?id=CVE-2015-2938
13 Apr 2015 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file. Vulnerabilidad de XSS en MediaWiki anterior a 1.19.24, 1.2x anterior a 1.23.9 y 1.24.x anterior a 1.24.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un fichero JavaScript personalizado, lo cual no ... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2014-9481 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-9481
09 Feb 2015 — The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML. La extensión Scribunto para MediaWiki, permite a atacantes remotos obtener el token de reversión y posiblemente otra información confidencial por medio de un módulo diseñado, relacionado con el desarmado de páginas HTML especiales. Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow ... • http://www.openwall.com/lists/oss-security/2014/12/21/2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 51EXPL: 0CVE-2014-9487 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-9487
09 Feb 2015 — The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2053. La biblioteca getid3 en MediaWiki en versiones anteriores a la 1.24.1, 1.23.8, 1.22.15 y 1.19.23 permite que atacantes remotos lean archivos arbitrarios, provoquen una denegación de servicio u otro tipo de impacto mediante un ataque XEE (XML External Entity)... • http://www.openwall.com/lists/oss-security/2015/01/03/13 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 46EXPL: 1CVE-2014-9477 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-9477
16 Jan 2015 — Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) url parameter. Múltiples vulnerabilidades de XSS en la extensión Listings para MediaWiki permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) name o (2) url. Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitr... • http://www.openwall.com/lists/oss-security/2014/12/21/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 46EXPL: 1CVE-2014-9478 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-9478
16 Jan 2015 — Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page. Vulnerabilidad de XSS en la previsualización en la extensión ExpandTemplates para MediaWiki, cuando $wgRawHTML está configurado a verdad, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro wpInpu... • http://www.openwall.com/lists/oss-security/2014/12/21/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 46EXPL: 1CVE-2014-9479 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-9479
16 Jan 2015 — Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox. Vulnerabilidad de XSS en la previsualización en la extensión TemplateSandbox para MediaWiki permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro text en Special:TemplateSandbox. Multiple vulnerabilities have been found in MediaWiki, the worst... • http://www.openwall.com/lists/oss-security/2014/12/21/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 46EXPL: 1CVE-2014-9480 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-9480
16 Jan 2015 — Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text extracts. Vulnerabilidad de XSS en la extensión Hovercards para MediaWiki permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores relacionados con extractos de textos. Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary ... • http://www.openwall.com/lists/oss-security/2014/12/21/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 46EXPL: 0CVE-2014-9475 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-9475
16 Jan 2015 — Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message. Vulnerabilidad de XSS en thumb.php en MediaWiki anterior a 1.19.23, 1.2x anterior a 1.22.15, 1.23.x anterior a 1.23.8, y 1.24.x anterior a 1.24.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de un mensaje ... • http://www.debian.org/security/2014/dsa-3110 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 46EXPL: 1CVE-2014-9476 – Gentoo Linux Security Advisory 201502-04
https://notcve.org/view.php?id=CVE-2014-9476
16 Jan 2015 — MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/." MediaWiki 1.2x anterior a 1.22.15, 1.23.x anterior a 1.23.8, y 1.24.x anterior a 1.24.1 permite a atacantes remotos evadir las restricciones CORS en $wgCrossSiteAJAXdomains a través de un dominio que tiene una coincidencia parcial ... • http://www.mandriva.com/security/advisories?name=MDVSA-2015:006 • CWE-264: Permissions, Privileges, and Access Controls •