CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-45373
https://notcve.org/view.php?id=CVE-2023-45373
An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occur via formatNumNoSeparators. Se descubrió un problema en la extensión ProofreadPage para MediaWiki anterior a 1.35.12, 1.36.x a 1.39.x anterior a 1.39.5 y 1.40.x anterior a 1.40.1. XSS puede ocurrir a través de formatNumNoSeparators. • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ProofreadPage/+/961262 https://phabricator.wikimedia.org/T345693 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-45372
https://notcve.org/view.php?id=CVE-2023-45372
An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter). Se descubrió un problema en la extensión de Wikibase para MediaWiki antes de 1.35.12, 1.36.x hasta 1.39.x antes de 1.39.5 y 1.40.x antes de 1.40.1. Durante la combinación de elementos, ItemMergeInteractor no tiene ningún filtro de edición en ejecución (por ejemplo, AbuseFilter). • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264 https://phabricator.wikimedia.org/T345064 • CWE-693: Protection Mechanism Failure •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-36674
https://notcve.org/view.php?id=CVE-2023-36674
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax. Se descubrió un problema en MediaWiki antes de 1.35.11, 1.36.x hasta 1.38.x antes de 1.38.7, 1.39.x antes de 1.39.4 y 1.40.x antes de 1.40.1. Es posible omitir la Lista de Imágenes Incorrectas (también conocida como badFile) utilizando el parámetro de thumb (también conocido como Manualthumb) de la Sintaxis del Archivo. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O https://phabricator.wikimedia.org/T335612 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37305
https://notcve.org/view.php?id=CVE-2023-37305
An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces. • https://gerrit.wikimedia.org/r/q/Ibe5f8e25dea155bbd811a65833394c0d4b906a34 https://phabricator.wikimedia.org/T326952 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37303
https://notcve.org/view.php?id=CVE-2023-37303
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message. • https://gerrit.wikimedia.org/r/q/I10a9273c542576b3f7bb38de68dcd2aa41cfb1b0 https://phabricator.wikimedia.org/T338276 •