CVSS: 6.1EPSS: 1%CPEs: 139EXPL: 1CVE-2011-1578
https://notcve.org/view.php?id=CVE-2011-1578
27 Apr 2011 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. Ejecución de secuencias de comandos en sitios cruzados (XSS) en MediaWiki antes de 1.16.3, cuando Internet Explorer 6 o versiones ant... • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 55EXPL: 0CVE-2011-0537
https://notcve.org/view.php?id=CVE-2011-0537
04 Feb 2011 — Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2, when running on Windows and possibly Novell Netware, allow remote attackers to include and execute arbitrary local PHP files via vectors related to a crafted language file and the Language::factory function. Múltiples vulnerabilidades de salto de directorio en (1) languages/Language.php y (2) includes/StubObject.php en MediaWiki v1.8.0 y otras versio... • http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.2.patch.gz • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 136EXPL: 0CVE-2011-0047
https://notcve.org/view.php?id=CVE-2011-0047
04 Feb 2011 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) comments, aka "CSS injection vulnerability." Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en MediaWiki anterior a v1.16.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML mediante una hoja de estilos (CSS) manipulada, también conocido como "vulnerabilidad de inyección de... • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 135EXPL: 0CVE-2011-0003
https://notcve.org/view.php?id=CVE-2011-0003
11 Jan 2011 — MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors. MediaWiki anterior a v1.16.1, cuando el usuario o el sitio JavaScript o CSS está activado, permite a atacantes remotos realizar ataques de clickjacking a través de vectores no especificados. • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2010-1648
https://notcve.org/view.php?id=CVE-2010-1648
07 Jun 2010 — Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en la interfaz de login de MediaWiki v1.15 anterior a v1.15.4 y v1.16 anterior a v1.16 beta 3, permite a atacantes remotos secuestar la autenticació... • http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043803.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2010-1647
https://notcve.org/view.php?id=CVE-2010-1647
07 Jun 2010 — Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer. Una vulnerabilidad de ejecución de comandos en sitios cruzados(XSS) en MediaWiki v1.15 antes de v1.15.4 y v1.16 antes de v1.16 beta 3 permite a atacantes remotos inyectar HTML o secuencias de comandos web a través de cadenas CSS debidamente modific... • http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043803.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 64EXPL: 1CVE-2010-1150
https://notcve.org/view.php?id=CVE-2010-1150
20 Apr 2010 — MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue. MediaWiki en versiones anteriores a la v1.15.3, y v1.6.x anteriores a la v1.16.0beta2, no gestiona apropiadamente un intento de inicio de sesión correctamente au... • http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.3.patch.gz • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 20EXPL: 0CVE-2005-1888
https://notcve.org/view.php?id=CVE-2005-1888
06 Jun 2005 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates. • http://sourceforge.net/project/shownotes.php?release_id=332231 •