Page 9 of 280 results (0.008 seconds)

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2021-46149

https://notcve.org/view.php?id=CVE-2021-46149

07 Jan 2022 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, versiones 1.36.x anteriores a 1.36.3 y versiones 1.37.x anteriores a 1.37.1.Puede producirse una denegación de servicio (consumo de recursos) al buscar una clave muy larga en una búsqueda de nombres de idiomas • https://gerrit.wikimedia.org/r/q/Ide32704cca578b9aecbce34bdcc0ac25c2a09a4d • CWE-400: Uncontrolled Resource Consumption •

CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2021-46150

https://notcve.org/view.php?id=CVE-2021-46150

07 Jan 2022 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, 1.36.x anteriores a 1.36.3 y 1.37.x anteriores a 1.37.1. Special:CheckUserLog permite el XSS de CheckUser debido a un manejo inapropiado de la fecha, como lo demuestra una carga útil de tipo XSS en MediaWiki:Octob... • https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CheckUser/+/79c2c49a18f96b159258958feca90fce964c350a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0

CVE-2021-46146

https://notcve.org/view.php?id=CVE-2021-46146

07 Jan 2022 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, 1.36.x anteriores a 1.36.3 y 1.37.x anteriores a 1.37.1. El componente WikibaseMediaInfo es vulnerable a un ataque de tipo XSS por medio de los campos caption de un archivo de medios determinado • https://gerrit.wikimedia.org/r/q/I58d37fb59f998f5bec4a018bf9da96a777f8ff78 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2021-45471

https://notcve.org/view.php?id=CVE-2021-45471

24 Dec 2021 — In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items. En MediaWiki versiones hasta 1.37, las direcciones IP bloqueadas pueden editar elementos de EntitySchema • https://gerrit.wikimedia.org/r/q/Iac86cf63bd014ef99e83dccfce9b8942e15d2bf9 •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2021-45472

https://notcve.org/view.php?id=CVE-2021-45472

24 Dec 2021 — In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used. En MediaWiki versiones hasta 1.37, un ataque de tipo XSS puede ocurrir en Wikibase porque una propiedad de identificador externo puede tener un formato de URL que incluye un marcador de sustitución de formato $1, y el esquema javascript: URL (entre otros) puede ser usado • https://gerrit.wikimedia.org/r/q/I37ece1dfdc80d38055067c9c4fa73ba591acd8bd • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2021-45474

https://notcve.org/view.php?id=CVE-2021-45474

24 Dec 2021 — In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter. En MediaWiki versiones hasta 1.37, el URI Special:ImportFile (también conocido como FileImporter) permite el XSS, como lo demuestra el parámetro clientUrl • https://gerrit.wikimedia.org/r/q/Id1c8910aeac5b452fbabeddab70360765518223e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2021-44858 – Gentoo Linux Security Advisory 202305-24

https://notcve.org/view.php?id=CVE-2021-44858

20 Dec 2021 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, 1.36.x versiones anteriores a 1.36.3 y 1.37.x versiones anteriores a 1.37.1. Es posible usar action=edit&undo= seguido de action=mcrundo y action=mcrrestor... • https://phabricator.wikimedia.org/T297322 • CWE-276: Incorrect Default Permissions •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2021-44857 – Gentoo Linux Security Advisory 202305-24

https://notcve.org/view.php?id=CVE-2021-44857

17 Dec 2021 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.5, versiones 1.36.x anteriores a 1.36.3 y versiones 1.37.x anteriores a 1.37.1. Es... • https://phabricator.wikimedia.org/T297322 • CWE-862: Missing Authorization •

CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2021-45038 – Gentoo Linux Security Advisory 202305-24

https://notcve.org/view.php?id=CVE-2021-45038

17 Dec 2021 — An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents. Se ha detectado un problema en MediaWiki versiones anteriores a versión 1.35.5, versiones 1.36.x anteriores a 1.36.3 y versiones 1.37.x anteriores a 1.37.1. Usando una consulta action=rollback, los atacantes pueden visualizar contenidos privados del wiki Multiple security issues were discovered in MediaWiki, a website engine actions ... • https://phabricator.wikimedia.org/T297574 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2021-41801 – Debian Security Advisory 4979-1

https://notcve.org/view.php?id=CVE-2021-41801

11 Oct 2021 — The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog) La extensión ReplaceText hasta la 1.41 para MediaWiki presenta un Control de Acceso Incorrecto. Cuando un usuario está bloqueado después de enviar un trabajo de reemplazo, el trabajo se sigue ejecutando, incluso si es posible ejecutar en un momento posterior (debido a una cola de es... • https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5 •