Page 25 of 253 results (0.015 seconds)

CVSS: 5.3EPSS: 0%CPEs: 23EXPL: 0

CVE-2013-4569

https://notcve.org/view.php?id=CVE-2013-4569

13 Dec 2013 — The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recent changes and watchlist" is enabled, allows remote attackers to obtain sensitive information (revision-deleted IPs) via the Recent Changes page. La extensión CleanChanges de MediaWiki anterior a 1.19.9, 1.20.x anterior a 1.20.8 y 1.21.x anterior a 1.21.3, cuando "Group changes by page in recent changes and watchlist" está activada, permite a atacantes remotos obtener in... • http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 20EXPL: 0

CVE-2013-4573

https://notcve.org/view.php?id=CVE-2013-4573

25 Nov 2013 — Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php. Vulnerabilidad de XSS en la extensión ZeroRatedMobileAccess para MediaWiki 1.19.x anterior a la versión 1.19.9, 1.20.x anterior a 1.20.8, y 1.21.x anterior a la versión 1.21.3 permite a atacantes remotos inyectar script web o HTML arbitrario a travé... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 2%CPEs: 21EXPL: 1

CVE-2013-4304 – Gentoo Linux Security Advisory 201310-21

https://notcve.org/view.php?id=CVE-2013-4304

28 Oct 2013 — The CentralAuth extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 caches a valid CentralAuthUser object in the centralauth_User cookie even when a user has not successfully logged in, which allows remote attackers to bypass authentication without a password. La extensión de MediaWiki CentralAuth 1.19.x anterior a 1.19.8, 1.20.7 anterior a 1.20.x y 1.21.x anterior 1.21.2 almacena en caché un objeto CentralAuthUser válida en la cookie centralauth_User incluso cuando ... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html • CWE-287: Improper Authentication •

CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2013-4306 – Gentoo Linux Security Advisory 201310-21

https://notcve.org/view.php?id=CVE-2013-4306

11 Oct 2013 — Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors. Vulnerabilidad cross-site request forgery (CSRF) en api/ApiQueryCheckUser.php en la extensión CheckUser para MediaWiki, posiblemente CheckUser anteriores a 2.3, permite a atacantes remotos secuestrar la autenticac... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2013-4305 – Gentoo Linux Security Advisory 201310-21

https://notcve.org/view.php?id=CVE-2013-4305

11 Oct 2013 — Cross-site scripting (XSS) vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded before September 2013, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. Vulnerabilidad de XSS en contrib/example.php de la extensión SyntaxHighlight GeSHi para MediaWiki, posiblemente la descargada antes de septiembre de 2013, permite a atacantes remotos inyectar script web arbitrario o HTML a través de PATH_INFO. Multiple vulnerabiliti... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2013-4303 – Mandriva Linux Security Advisory 2013-235

https://notcve.org/view.php?id=CVE-2013-4303

16 Sep 2013 — includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php. El archivo includes/libs/IEUrlExtension.php en la API MediaWiki en MediaWiki versiones 1.19.x anteriores a 1.19.8, versiones 1.20.x an... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 1%CPEs: 17EXPL: 1

CVE-2013-4301 – Mandriva Linux Security Advisory 2013-235

https://notcve.org/view.php?id=CVE-2013-4301

16 Sep 2013 — includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message. includes/resourceloader/ResourceLoaderContext.php en MediaWiki 1.19.x anterior a la versión 1.19.8, 1.20.x anterior a 1.20.7, y 1.21.x anterior a la versión 1.21.2 permite a atacantes remot... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 8.8EPSS: 0%CPEs: 17EXPL: 0

CVE-2013-4302 – Mandriva Linux Security Advisory 2013-235

https://notcve.org/view.php?id=CVE-2013-4302

13 Sep 2013 — (1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php. Los scripts ApiBlock.php, ApiCreateAccount.php, ApiLogin.php, ApiMain.php, ApiQueryDeletedrevs.php, ApiTokens.p... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.1EPSS: 0%CPEs: 20EXPL: 0

CVE-2013-4307 – Gentoo Linux Security Advisory 201310-21

https://notcve.org/view.php?id=CVE-2013-4307

11 Sep 2013 — Multiple cross-site scripting (XSS) vulnerabilities in repo/includes/EntityView.php in the Wikibase extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow (1) remote attackers to inject arbitrary web script or HTML via a label in the "In other languages" section or (2) remote administrators to inject arbitrary web script or HTML via a description. Multiples vulnerabilidades XSS en repo/includes/EntityView.php en la extensión de Wikibase para MediaWiki 1.19.x anter... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 22EXPL: 0

CVE-2013-4308 – Gentoo Linux Security Advisory 201310-21

https://notcve.org/view.php?id=CVE-2013-4308

11 Sep 2013 — Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject. Vulnerabilidad cross-site scripting (XSS) en pages/TalkpageHistoryView.php en la extensión LiquidThreads (LQT) 2.x y posiblemente 3.x para MediaWiki 1.19.x (anteriores a 1.19.8) 1.20.x (anteriores a 1.20.7) y 1.2... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •