CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2022-34911 – Gentoo Linux Security Advisory 202305-24
https://notcve.org/view.php?id=CVE-2022-34911
02 Jul 2022 — An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text(). Se ha detectado un problema en MediaWiki versiones ante... • https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2022-34912 – Gentoo Linux Security Advisory 202305-24
https://notcve.org/view.php?id=CVE-2022-34912
02 Jul 2022 — An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped. Se ha descubierto un problema en MediaWiki versiones anteriores a 1.37.3 y en versiones 1.38.x anteriores a 1.38.1. El contributions-title, usa en Special:Contributions, es usadao como título de la página sin escapar. • https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34750
https://notcve.org/view.php?id=CVE-2022-34750
28 Jun 2022 — An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty. Se ha detectado un problema en MediaWiki versiones hasta 1.38.1. • https://gerrit.wikimedia.org/r/q/I8171bfef73e525d73efa60b407ce147130ea4742 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29969
https://notcve.org/view.php?id=CVE-2022-29969
02 May 2022 — The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true). La extensión RSS versiones anteriores a 29-04-2022 para MediaWiki permite un ataque de tipo XSS por medio de un elemento rss (si el feed está en $wgRSSUrlWhitelist y $wgRSSAllowLinkTag es true) • https://gerrit.wikimedia.org/r/c/787807 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28323
https://notcve.org/view.php?id=CVE-2022-28323
30 Apr 2022 — An issue was discovered in MediaWiki through 1.37.2. The SecurePoll extension allows a leak because sorting by timestamp is supported, Se ha detectado un problema en MediaWiki versiones hasta 1.37.2. La extensión SecurePoll permite un filtrado porque es admitida una ordenación por marca de tiempo • https://gerrit.wikimedia.org/r/q/93758c4c13b972d240a6313e0472df1667118893 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29903
https://notcve.org/view.php?id=CVE-2022-29903
29 Apr 2022 — The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains. La extensión Private Domains para MediaWiki versiones hasta 1.37.2, (anteriores a 1ad65d4c1c199b375ea80988d99ab51ae068f766) permite una vulnerabilidad de tipo CSRF para la edición de páginas que almacenan la configuración de la extensión. El atacante debe lanzar ... • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PrivateDomains/+/783416 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29904
https://notcve.org/view.php?id=CVE-2022-29904
29 Apr 2022 — The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' constraints. La extensión SemanticDrilldown para MediaWiki versiones hasta 1.37.2 (anteriores a e688bdba6434591b5dff689a45e4d53459954773) permite una inyección SQL con determinadas restricciones "-" y "_" • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SemanticDrilldown/+/785213 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29905
https://notcve.org/view.php?id=CVE-2022-29905
29 Apr 2022 — The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF. La extensión FanBoxes para MediaWiki versiones hasta 1.37.2 (antes de 027ffb0b9d6fe0d823810cf03f5b562a212162d4) permite un ataque de tipo CSRF de Special:UserBoxes • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FanBoxes/+/786327 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29906
https://notcve.org/view.php?id=CVE-2022-29906
29 Apr 2022 — The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user. El módulo admin API en la extensión QuizGame para MediaWiki versiones hasta 1.37.2 (anteriores a 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omite una comprobación para el usuario quizadmin • https://gerrit.wikimedia.org/r/c/mediawiki/extensions/QuizGame/+/765651 • CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29907
https://notcve.org/view.php?id=CVE-2022-29907
29 Apr 2022 — The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages. El skin Nimbus para MediaWiki versiones hasta 1.37.2 (anteriores a 6f9c8fb868345701d9544a54d9752515aace39df) permite un uso de XSS en los mensajes de los enlaces Advertise • https://gerrit.wikimedia.org/r/c/786959 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •