CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-28205 – Gentoo Linux Security Advisory 202305-24
https://notcve.org/view.php?id=CVE-2022-28205
30 Mar 2022 — An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future. Se ha detectado un problema en MediaWiki versiones hasta 1.37.1. La extensión CentralAuth maneja inapropiadamente un problema de ttl para grupos que expiran en el futuro Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. Versions greater than or equal to 1.25.2 are affected. • https://gerrit.wikimedia.org/r/q/Ic6ba1a37b78df5b342ceeba4c1493dbde583b81f •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-28206 – Gentoo Linux Security Advisory 202305-24
https://notcve.org/view.php?id=CVE-2022-28206
30 Mar 2022 — An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights. Se ha detectado un problema en MediaWiki versiones hasta 1.37.1. El archivo ImportPlanValidator.php en la extensión FileImporter maneja inapropiadamente la comprobación de los derechos de edición Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. Versions greater than or equal to 1.25.2 are affected. • https://gerrit.wikimedia.org/r/q/I84be9cd3639b8ab0e037a4ec2d3f2f478f0989c5 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28209 – Gentoo Linux Security Advisory 202305-24
https://notcve.org/view.php?id=CVE-2022-28209
30 Mar 2022 — An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect. Se ha detectado un problema en Mediawiki versiones hasta 1.37.1. La comprobación del permiso override-antispoof en la extensión AntiSpoof es incorrecta Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. Versions greater than or equal to 1.25.2 are affected. • https://gerrit.wikimedia.org/r/q/Id8c4e2e336695ce70ccdf8a51ad729bf4a99f8f7 •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2022-28202 – Gentoo Linux Security Advisory 202305-24
https://notcve.org/view.php?id=CVE-2022-28202
30 Mar 2022 — An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete. Se ha detectado un problema de tipo XSS en MediaWiki versiones anteriores a 1.35.6, versiones 1.36.x anteriores a 1.36.4 y versiones 1.37.x anteriores a 1.37.2. Las propiedades widthheight, widthheightpage y nbytes de los mensajes no son escapadas cuando son usadas en galer... • https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2017-0371
https://notcve.org/view.php?id=CVE-2017-0371
18 Feb 2022 — MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute. MediaWiki versiones anteriores a 1.23.16, versiones 1.24.x hasta 1.27.x anteriores a 1.27.2 y versiones 1.28.x anteriores a 1.28.1, permite a atacantes remotos descubrir las direcciones IP de los visitantes del Wiki p... • https://phabricator.wikimedia.org/T140591 •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-46147
https://notcve.org/view.php?id=CVE-2021-46147
07 Jan 2022 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, 1.36.x anteriores a 1.36.3 y 1.37.x anteriores a 1.37.1. MassEditRegex permite un ataque de tipo CSRF • https://gerrit.wikimedia.org/r/q/I5980de35b0a01b5242b68b7b0bdc08adf5d968d8 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-46148
https://notcve.org/view.php?id=CVE-2021-46148
07 Jan 2022 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, 1.36.x anteriores a 1.36.3 y 1.37.x anteriores a 1.37.1. Algunos usuarios no privilegiados pueden visualizar información confidencial (por ejemplo, direcciones IP y encabezados User-... • https://gerrit.wikimedia.org/r/q/Ib2715adb281f8892b586dcb1895e87ac0eb548b0 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-46149
https://notcve.org/view.php?id=CVE-2021-46149
07 Jan 2022 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, versiones 1.36.x anteriores a 1.36.3 y versiones 1.37.x anteriores a 1.37.1.Puede producirse una denegación de servicio (consumo de recursos) al buscar una clave muy larga en una búsqueda de nombres de idiomas • https://gerrit.wikimedia.org/r/q/Ide32704cca578b9aecbce34bdcc0ac25c2a09a4d • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-46150
https://notcve.org/view.php?id=CVE-2021-46150
07 Jan 2022 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, 1.36.x anteriores a 1.36.3 y 1.37.x anteriores a 1.37.1. Special:CheckUserLog permite el XSS de CheckUser debido a un manejo inapropiado de la fecha, como lo demuestra una carga útil de tipo XSS en MediaWiki:Octob... • https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CheckUser/+/79c2c49a18f96b159258958feca90fce964c350a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2021-46146
https://notcve.org/view.php?id=CVE-2021-46146
07 Jan 2022 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, 1.36.x anteriores a 1.36.3 y 1.37.x anteriores a 1.37.1. El componente WikibaseMediaInfo es vulnerable a un ataque de tipo XSS por medio de los campos caption de un archivo de medios determinado • https://gerrit.wikimedia.org/r/q/I58d37fb59f998f5bec4a018bf9da96a777f8ff78 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •