CVSS: 6.1EPSS: 1%CPEs: 155EXPL: 2CVE-2012-2698 – MediaWiki 1.x - 'uselang' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2698
29 Jun 2012 — Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en includes/SkinTemplate.php de MediaWiki anteriores a 1.17.5, 1.8.x anteriores a 1.18.4, y 1.19.x anteriores a 1.19.1. Permite a atacantes remotos inyectar codi... • https://www.exploit-db.com/exploits/37404 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4360
https://notcve.org/view.php?id=CVE-2011-4360
08 Jan 2012 — MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter. MediaWiki antes de v1.17.1 permite a atacantes remotos obtener los títulos de las páginas de todas las páginas restringidas a través de una serie de solicitudes relacionadas con los parámetros (1) curid o (2) oldid. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4361
https://notcve.org/view.php?id=CVE-2011-4361
08 Jan 2012 — MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions. MediaWiki, antes de v1.17.1, no comprueba los permisos de lectura antes de manejar las peticiones action=ajax, lo que permite a atacantes remotos obtener información sensible (... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html • CWE-276: Incorrect Default Permissions •
CVSS: 9.8EPSS: 1%CPEs: 137EXPL: 0CVE-2011-1766
https://notcve.org/view.php?id=CVE-2011-1766
23 May 2011 — includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation. includes/User.php en MediaWiki anterior a v1.16.5, cuando wgBlockDisablesLogin es activado, no limpia ciertos datos de caché después de verificar un fallo de un token auth, lo que permite a atac... • http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060435.html • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 2%CPEs: 141EXPL: 1CVE-2011-1765
https://notcve.org/view.php?id=CVE-2011-1765
23 May 2011 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587. Vulnerabilidad de ejecución de sec... • http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060435.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 126EXPL: 0CVE-2010-2788
https://notcve.org/view.php?id=CVE-2010-2788
27 Apr 2011 — Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en profileinfo.php en MediaWiki anterior a v1.15.5, cyabdi wgEnableProfileInfo está activado, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro "filter". • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 140EXPL: 0CVE-2011-1587
https://notcve.org/view.php?id=CVE-2011-1587
27 Apr 2011 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578. Vulnerabilidad de ejecución de ... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-April/000097.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 135EXPL: 0CVE-2011-1580
https://notcve.org/view.php?id=CVE-2011-1580
27 Apr 2011 — The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request. La funcionalidad de importación transwiki en MediaWiki antes de v1.16.3 no comprueba correctamente los privilegios, lo que permite a usuarios autenticados remotamente realizar las importaciones de cualquier wiki wgImportSources a través de una petición POST manipulada. • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 2%CPEs: 135EXPL: 1CVE-2011-1579
https://notcve.org/view.php?id=CVE-2011-1579
27 Apr 2011 — The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the \2f\2a and \2a\2f hex strings to surround CSS comments. La función checkCss en includes/Sanitizer.php en el analizador wikitext de MediaWiki antes de v1.16.3, no valida correctamente las hojas de estilo en cascada (CSS) ... • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 1%CPEs: 139EXPL: 1CVE-2011-1578
https://notcve.org/view.php?id=CVE-2011-1578
27 Apr 2011 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. Ejecución de secuencias de comandos en sitios cruzados (XSS) en MediaWiki antes de 1.16.3, cuando Internet Explorer 6 o versiones ant... • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •