CVSS: 5.0EPSS: 0%CPEs: 74EXPL: 0CVE-2013-2032
https://notcve.org/view.php?id=CVE-2013-2032
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks. MediaWiki anteriores a 1.19.6, y 1.20.x anteriores a 1.20.5 no permite a las extensiones prevenir cambios en las contraseñas sin usar Special:PasswordReset y Special:ChangePassword, lo cual permite a atacantes remotos sortear restricciones de acceso en extensiones que sólo implementan uno de estos bloques. • http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html http://secunia.com/advisories/55433 http://security.gentoo.org/glsa/glsa-201310-21.xml https://bugzilla.wikimedia.org/show_bug.cgi?id=46590 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2013-1951
https://notcve.org/view.php?id=CVE-2013-1951
A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names. Una vulnerabilidad de tipo cross-site scripting (XSS) en MediaWiki versiones anteriores a 1.19.5 y versiones 1.20.x anteriores a 1.20.4 y permite a atacantes remotos inyectar script web o HTML arbitrario por medio de nombres de función de Lua. • http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104022.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104027.html http://security.gentoo.org/glsa/glsa-201310-21.xml http://www.openwall.com/lists/oss-security/2013/04/16/12 http://www.securityfocus.com/bid/59077 https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-1951 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1951 https://phabricator.wikimedia.org/T48084 https://security-tr • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 5%CPEs: 15EXPL: 0CVE-2013-2114
https://notcve.org/view.php?id=CVE-2013-2114
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. Vulnerabilidad de subida sin restricciones de ficheros en la API de subida de fragmentos en MediaWiki 1.19 a 1.19.6 y 1.20.x anteriores a 1.20.6 permite a atacantes remotos ejecutar código arbitrario mediante la subida de un fichero con extensión ejecutable. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-May/000131.html http://secunia.com/advisories/55433 http://security.gentoo.org/glsa/glsa-201310-21.xml http://www.openwall.com/lists/oss-security/2013/05/24/3 https://bugzilla.wikimedia.org/show_bug.cgi?id=48306 •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2013-4305
https://notcve.org/view.php?id=CVE-2013-4305
Cross-site scripting (XSS) vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded before September 2013, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. Vulnerabilidad de XSS en contrib/example.php de la extensión SyntaxHighlight GeSHi para MediaWiki, posiblemente la descargada antes de septiembre de 2013, permite a atacantes remotos inyectar script web arbitrario o HTML a través de PATH_INFO. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html http://osvdb.org/96909 http://seclists.org/oss-sec/2013/q3/553 https://bugzilla.wikimedia.org/show_bug.cgi?id=49070 https://exchange.xforce.ibmcloud.com/vulnerabilities/86890 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-4306
https://notcve.org/view.php?id=CVE-2013-4306
Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors. Vulnerabilidad cross-site request forgery (CSRF) en api/ApiQueryCheckUser.php en la extensión CheckUser para MediaWiki, posiblemente CheckUser anteriores a 2.3, permite a atacantes remotos secuestrar la autenticación de usuarios de forma arbitraria para peticiones que "realizan acciones de escritura sensibles" a través de vectores no especificados. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html http://osvdb.org/96908 http://seclists.org/oss-sec/2013/q3/553 http://www.securityfocus.com/bid/62210 https://bugzilla.wikimedia.org/show_bug.cgi?id=45019 https://exchange.xforce.ibmcloud.com/vulnerabilities/86893 https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651 • CWE-352: Cross-Site Request Forgery (CSRF) •