CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-45370
https://notcve.org/view.php?id=CVE-2023-45370
09 Oct 2023 — An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManagerLogo and Special:SportsTeamsManagerLogo do not check for the sportsteamsmanager user right, and thus an attacker may be able to affect pages that are concerned with sports teams. Se descubrió un problema en la extensión SportsTeams para MediaWiki antes de 1.35.12, 1.36.x hasta 1.39.x antes de 1.39.5 y 1.40.x antes de 1.40.1. Sport... • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SportsTeams/+/959699 • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-45369
https://notcve.org/view.php?id=CVE-2023-45369
09 Oct 2023 — An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of hidden users are exposed. Se descubrió un problema en la extensión PageTriage para MediaWiki anterior a 1.35.12, 1.36.x a 1.39.x anterior a 1.39.5 y 1.40.x anterior a 1.40.1. Los nombres de usuario de usuarios ocultos están expuestos. • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PageTriage/+/960676 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-36674 – Debian Security Advisory 5447-1
https://notcve.org/view.php?id=CVE-2023-36674
06 Jul 2023 — An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax. Se descubrió un problema en MediaWiki antes de 1.35.11, 1.36.x hasta 1.38.x antes de 1.38.7, 1.39.x antes de 1.39.4 y 1.40.x antes de 1.40.1. Es posible omitir la Lista de Imágenes Incorrectas (también conocida como badFile) utilizando el parámetro ... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37303
https://notcve.org/view.php?id=CVE-2023-37303
30 Jun 2023 — An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message. • https://gerrit.wikimedia.org/r/q/I10a9273c542576b3f7bb38de68dcd2aa41cfb1b0 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37301
https://notcve.org/view.php?id=CVE-2023-37301
30 Jun 2023 — An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur. • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933663 • CWE-326: Inadequate Encryption Strength •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37300
https://notcve.org/view.php?id=CVE-2023-37300
30 Jun 2023 — An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users. • https://gerrit.wikimedia.org/r/q/I993fdcae1fedb7dd543b35a477026bc727615b0a • CWE-863: Incorrect Authorization •
CVSS: 6.4EPSS: 1%CPEs: 1EXPL: 1CVE-2023-37302
https://notcve.org/view.php?id=CVE-2023-37302
30 Jun 2023 — An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute). • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37304
https://notcve.org/view.php?id=CVE-2023-37304
30 Jun 2023 — An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature. • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DoubleWiki/+/932825 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37305
https://notcve.org/view.php?id=CVE-2023-37305
30 Jun 2023 — An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces. • https://gerrit.wikimedia.org/r/q/Ibe5f8e25dea155bbd811a65833394c0d4b906a34 • CWE-203: Observable Discrepancy •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37254
https://notcve.org/view.php?id=CVE-2023-37254
29 Jun 2023 — An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format. • https://phabricator.wikimedia.org/T331065 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •