CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2013-1818
https://notcve.org/view.php?id=CVE-2013-1818
maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors. maintenance/mwdoc-filter.php en MediaWiki anterior a 1.20.3 permite a atacantes remotos leer archivos arbitrarios a través de vectores no especificados. • http://www.mediawiki.org/wiki/Release_notes/1.20 http://www.securityfocus.com/bid/58304 https://bugzilla.wikimedia.org/show_bug.cgi?id=45355 https://exchange.xforce.ibmcloud.com/vulnerabilities/88363 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2013-1951
https://notcve.org/view.php?id=CVE-2013-1951
A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names. Una vulnerabilidad de tipo cross-site scripting (XSS) en MediaWiki versiones anteriores a 1.19.5 y versiones 1.20.x anteriores a 1.20.4 y permite a atacantes remotos inyectar script web o HTML arbitrario por medio de nombres de función de Lua. • http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104022.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104027.html http://security.gentoo.org/glsa/glsa-201310-21.xml http://www.openwall.com/lists/oss-security/2013/04/16/12 http://www.securityfocus.com/bid/59077 https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-1951 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1951 https://phabricator.wikimedia.org/T48084 https://security-tr • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 2%CPEs: 155EXPL: 2CVE-2012-2698 – MediaWiki 1.x - 'uselang' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2698
Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en includes/SkinTemplate.php de MediaWiki anteriores a 1.17.5, 1.8.x anteriores a 1.18.4, y 1.19.x anteriores a 1.19.1. Permite a atacantes remotos inyectar codigo de script web o código HTML de su elección a través del parámetro uselang de index.php/Main_page. • https://www.exploit-db.com/exploits/37404 http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000116.html http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000117.html http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000118.html http://secunia.com/advisories/49484 http://securitytracker.com/id?1027179 http://www.openwall.com/lists/oss-security/2012/06/14/2 http://www.osvdb.org/82983 https://bugzilla.wikimedia.org/show_bug.cgi?id=36938 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4360
https://notcve.org/view.php?id=CVE-2011-4360
MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter. MediaWiki antes de v1.17.1 permite a atacantes remotos obtener los títulos de las páginas de todas las páginas restringidas a través de una serie de solicitudes relacionadas con los parámetros (1) curid o (2) oldid. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html http://openwall.com/lists/oss-security/2011/11/29/12 http://openwall.com/lists/oss-security/2011/11/29/6 http://www.debian.org/security/2011/dsa-2366 https://bugzilla.redhat.com/show_bug.cgi?id=758171 https://bugzilla.wikimedia.org/show_bug.cgi?id=32276 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4361
https://notcve.org/view.php?id=CVE-2011-4361
MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions. MediaWiki, antes de v1.17.1, no comprueba los permisos de lectura antes de manejar las peticiones action=ajax, lo que permite a atacantes remotos obtener información sensible (1) aprovechandose de la función SpecialUpload::ajaxGetExistsWarning, o (2) aprovechando una extensión, como lo demuestra las extensiones CategoryTree, ExtTab y InlineEditor. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html http://openwall.com/lists/oss-security/2011/11/29/12 http://openwall.com/lists/oss-security/2011/11/29/6 http://www.debian.org/security/2011/dsa-2366 https://bugzilla.redhat.com/show_bug.cgi?id=758171 https://bugzilla.wikimedia.org/show_bug.cgi?id=32616 • CWE-276: Incorrect Default Permissions •