CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2012-1578
https://notcve.org/view.php?id=CVE-2012-1578
09 Sep 2012 — Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en MediaWiki V1.17.x anteriores a v1.17.3 y v.18.x anteriores a v1.18.2, permite a atacantes remo... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 1CVE-2012-1579
https://notcve.org/view.php?id=CVE-2012-1579
09 Sep 2012 — The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information. El gestor de recursos en MediaWiki v1.17.x antes de v1.17.3 y v1.18.x antes de v1.18.2 incluye datos privados, como tokens CSRF en un archivo JavaScript, lo que permite a atacantes remotos obtener información sensible. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2012-1580
https://notcve.org/view.php?id=CVE-2012-1580
09 Sep 2012 — Cross-site request forgery (CSRF) vulnerability in Special:Upload in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload files. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en Special:Upload en MediaWiki v1.17.x antes de v1.17.3 y v1.18.x antes de v1.18.2, permite a atacantes remotos secuestrar la autenticación de las víctimas no especificadas para las solicitudes que suben archi... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.1EPSS: 0%CPEs: 11EXPL: 0CVE-2012-1581
https://notcve.org/view.php?id=CVE-2012-1581
09 Sep 2012 — MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users. MediaWiki v1.17.x anterior a v1.17.3 y v1.18.x anterior a v1.18.2 usa números aleatorios débiles para el reseteo de contraseñas de los tokens, lo que facilita a los atacantes remotos cambiar las contraseñas de los usuarios. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0CVE-2012-1582
https://notcve.org/view.php?id=CVE-2012-1582
09 Sep 2012 — Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script or HTML via a crafted page with "forged strip item markers," as demonstrated using the CharInsert extension. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el analizador wikitext en MediaWiki v1.17.x antes de v1.17.3 y v1.18.x antes de v1.18.2 permite a atacantes remotos inyectar secuencias de coma... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 18%CPEs: 155EXPL: 2CVE-2012-2698 – MediaWiki 1.x - 'uselang' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2698
29 Jun 2012 — Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en includes/SkinTemplate.php de MediaWiki anteriores a 1.17.5, 1.8.x anteriores a 1.18.4, y 1.19.x anteriores a 1.19.1. Permite a atacantes remotos inyectar codi... • https://www.exploit-db.com/exploits/37404 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4360
https://notcve.org/view.php?id=CVE-2011-4360
08 Jan 2012 — MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter. MediaWiki antes de v1.17.1 permite a atacantes remotos obtener los títulos de las páginas de todas las páginas restringidas a través de una serie de solicitudes relacionadas con los parámetros (1) curid o (2) oldid. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4361
https://notcve.org/view.php?id=CVE-2011-4361
08 Jan 2012 — MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions. MediaWiki, antes de v1.17.1, no comprueba los permisos de lectura antes de manejar las peticiones action=ajax, lo que permite a atacantes remotos obtener información sensible (... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html • CWE-276: Incorrect Default Permissions •
CVSS: 6.1EPSS: 0%CPEs: 141EXPL: 1CVE-2011-1765
https://notcve.org/view.php?id=CVE-2011-1765
23 May 2011 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587. Vulnerabilidad de ejecución de sec... • http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060435.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 137EXPL: 0CVE-2011-1766
https://notcve.org/view.php?id=CVE-2011-1766
23 May 2011 — includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation. includes/User.php en MediaWiki anterior a v1.16.5, cuando wgBlockDisablesLogin es activado, no limpia ciertos datos de caché después de verificar un fallo de un token auth, lo que permite a atac... • http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060435.html • CWE-287: Improper Authentication •