Page 29 of 323 results (0.010 seconds)

CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0

CVE-2010-1647

https://notcve.org/view.php?id=CVE-2010-1647

07 Jun 2010 — Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer. Una vulnerabilidad de ejecución de comandos en sitios cruzados(XSS) en MediaWiki v1.15 antes de v1.15.4 y v1.16 antes de v1.16 beta 3 permite a atacantes remotos inyectar HTML o secuencias de comandos web a través de cadenas CSS debidamente modific... • http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043803.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0

CVE-2010-1648

https://notcve.org/view.php?id=CVE-2010-1648

07 Jun 2010 — Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en la interfaz de login de MediaWiki v1.15 anterior a v1.15.4 y v1.16 anterior a v1.16 beta 3, permite a atacantes remotos secuestar la autenticació... • http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043803.html • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 8.0EPSS: 0%CPEs: 64EXPL: 1

CVE-2010-1150

https://notcve.org/view.php?id=CVE-2010-1150

20 Apr 2010 — MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue. MediaWiki en versiones anteriores a la v1.15.3, y v1.6.x anteriores a la v1.16.0beta2, no gestiona apropiadamente un intento de inicio de sesión correctamente au... • http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.3.patch.gz • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 5.3EPSS: 0%CPEs: 92EXPL: 0

CVE-2010-1189

https://notcve.org/view.php?id=CVE-2010-1189

31 Mar 2010 — MediaWiki before 1.15.2 does not prevent wiki editors from linking to images from other web sites in wiki pages, which allows editors to obtain IP addresses and other information of wiki users by adding a link to an image on an attacker-controlled web site, aka "CSS validation issue." MediaWiki en versiones anteriores a la 1.15.2 no impide a los editores de wiki enlazar a imagenes de otros sitios web en las páginas del wiki, lo que permite a los editores obtener direcciones IP y otra información de los usua... • http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html • CWE-20: Improper Input Validation •

CVSS: 9.1EPSS: 0%CPEs: 92EXPL: 0

CVE-2010-1190

https://notcve.org/view.php?id=CVE-2010-1190

31 Mar 2010 — thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as img_auth.php, does not check user permissions before providing scaled images, which allows remote attackers to bypass intended access restrictions and read private images via unspecified manipulations. thumb.php en MediaWiki en versiones anteriores a la 1.15.2, cuando es usado con mecanismos de restricción de acceso como en img_auth.php, no verifica los permisos del usuario antes de proporcionar imágenes a escala, lo ... • http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1

CVE-2009-4589

https://notcve.org/view.php?id=CVE-2009-4589

07 Jan 2010 — Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la implementación Special:Block en la función getContribsLink en SpecialBlockip.php en MediaWiki v1.14.0 y v1.15.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elec... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-July/000087.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0

CVE-2009-0737

https://notcve.org/view.php?id=CVE-2009-0737

25 Feb 2009 — Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12 before 1.12.4, and 1.13 before 1.13.4, when the installer is in active use, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados - XSS - en el instalador basado en web (config/index.php) en MediaWiki v1.6 anteriores a v1.6.12, v1.12 anteriores a v1.12.4, y v... • http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0

CVE-2008-5249

https://notcve.org/view.php?id=CVE-2008-5249

19 Dec 2008 — Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Una vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en MediaWiki 1.13.0 a 1.13.2 permite a atacantes remotos inyectar HTML o secuencias de comandos web arbitrarias a través de vectores no especificados. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0

CVE-2008-5250

https://notcve.org/view.php?id=CVE-2008-5250

19 Dec 2008 — Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page. Una vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en versiones de MediaWiki anteriores a 1.6.11, 1.12.x anteriores a 1.12.2, y 1.13.3 anteriores a 1.1... • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 54EXPL: 0

CVE-2008-5252

https://notcve.org/view.php?id=CVE-2008-5252

19 Dec 2008 — Cross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1.13.x before 1.13.3 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors. Una vulnerabilidad de falsificación de petición en sitios cruzados en la funcionalidad Special:Import en MediaWiki 1.3.0 a 1.6.10, 1.12.x antes de 1.12.2, y 1.13.3 antes de 1.13.x, permite a atacantes remotos llevar a cabo acciones no especificadas como... • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html • CWE-352: Cross-Site Request Forgery (CSRF) •