CVSS: 4.3EPSS: 0%CPEs: 71EXPL: 0CVE-2013-2031
https://notcve.org/view.php?id=CVE-2013-2031
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox. MediaWiki anteriores a 1.19.6, y 1.20.x anteriores a 1.20.5, permite a atacantes remotos realizar ataques cross-site scripting (XSS), como demostrado por una sección CDATA conteniendo secuencias válidas codificadas con UTF-7 en un fichero SVG, el cual es interpretado incorrectamente como UTF-8 por Chrome y Firefox. • http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html http://secunia.com/advisories/55433 http://secunia.com/advisories/57472 http://security.gentoo.org/glsa/glsa-201310-21.xml http://www.debian.org/security/2014/dsa-2891 http://www • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2013-1817
https://notcve.org/view.php?id=CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information. MediaWiki versiones anteriores a la versión 1.19.4 y versiones 1.20.x anteriores a la versión 1.20.3, contiene un error en el script api.php lo que permite a atacantes remotos obtener información confidencial. • http://security.gentoo.org/glsa/glsa-201310-21.xml http://www.openwall.com/lists/oss-security/2013/03/05/4 http://www.securityfocus.com/bid/58305 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1817 https://exchange.xforce.ibmcloud.com/vulnerabilities/88359 https://security-tracker.debian.org/tracker/CVE-2013-1817 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2013-1818
https://notcve.org/view.php?id=CVE-2013-1818
maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors. maintenance/mwdoc-filter.php en MediaWiki anterior a 1.20.3 permite a atacantes remotos leer archivos arbitrarios a través de vectores no especificados. • http://www.mediawiki.org/wiki/Release_notes/1.20 http://www.securityfocus.com/bid/58304 https://bugzilla.wikimedia.org/show_bug.cgi?id=45355 https://exchange.xforce.ibmcloud.com/vulnerabilities/88363 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2013-1951
https://notcve.org/view.php?id=CVE-2013-1951
A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names. Una vulnerabilidad de tipo cross-site scripting (XSS) en MediaWiki versiones anteriores a 1.19.5 y versiones 1.20.x anteriores a 1.20.4 y permite a atacantes remotos inyectar script web o HTML arbitrario por medio de nombres de función de Lua. • http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104022.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104027.html http://security.gentoo.org/glsa/glsa-201310-21.xml http://www.openwall.com/lists/oss-security/2013/04/16/12 http://www.securityfocus.com/bid/59077 https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-1951 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1951 https://phabricator.wikimedia.org/T48084 https://security-tr • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 5%CPEs: 11EXPL: 0CVE-2012-4885
https://notcve.org/view.php?id=CVE-2012-4885
The wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to cause a denial of service (infinite loop) via certain input, as demonstrated by the padleft function. El analizador wikitext en MediaWiki 1.17.x antes de 1.17.3 y 1.18.x antes de 1.18.2 permite a atacantes remotos provocar una denegación de servicio (bucle infinito) a través de ciertas entradas, como lo demuestra la función PadLeft. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html http://secunia.com/advisories/48504 http://www.openwall.com/lists/oss-security/2012/03/22/9 http://www.openwall.com/lists/oss-security/2012/03/24/1 http://www.securityfocus.com/bid/52689 https://bugzilla.wikimedia.org/show_bug.cgi?id=22555 https://bugzilla.wikimedia.org/show_bug.cgi?id=35315 •