Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

mediawiki mediawiki 1.18.2 vulnerabilities and exploits

(subscribe to this query)
6.8
CVSSv2
CVE-2012-5391
Session fixation vulnerability in Special:UserLogin in MediaWiki prior to 1.18.6, 1.19.x prior to 1.19.3, and 1.20.x prior to 1.20.1 allows remote malicious users to hijack web sessions via the session_id.
Mediawiki Mediawiki 1.18.1Mediawiki Mediawiki 1.18.2Mediawiki Mediawiki 1.18.3Mediawiki Mediawiki 1.18Mediawiki Mediawiki 1.18.0Mediawiki MediawikiMediawiki Mediawiki 1.18.4Mediawiki Mediawiki 1.19Mediawiki Mediawiki 1.19.1Mediawiki Mediawiki 1.19.2Mediawiki Mediawiki 1.20
6.8
CVSSv2
CVE-2012-5395
Session fixation vulnerability in the CentralAuth extension for MediaWiki prior to 1.18.6, 1.19.x prior to 1.19.3, and 1.20.x prior to 1.20.1 allows remote malicious users to hijack web sessions via the centralauth_Session cookie.
Mediawiki Mediawiki 1.20Mediawiki Mediawiki 1.19Mediawiki Mediawiki 1.19.1Mediawiki Mediawiki 1.19.2Mediawiki Mediawiki 1.18.0Mediawiki Mediawiki 1.18.1Mediawiki Mediawiki 1.18.2Mediawiki MediawikiMediawiki Mediawiki 1.18Mediawiki Mediawiki 1.18.4Mediawiki Mediawiki 1.18.3
4.3
CVSSv2
CVE-2013-2031
MediaWiki prior to 1.19.6 and 1.20.x prior to 1.20.5 allows remote malicious users to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome an...
Gentoo LinuxMediawiki MediawikiMediawiki Mediawiki 1.19.4Mediawiki Mediawiki 1.19Mediawiki Mediawiki 1.18.3Mediawiki Mediawiki 1.17.3Mediawiki Mediawiki 1.17.2Mediawiki Mediawiki 1.16.1Mediawiki Mediawiki 1.16.0Mediawiki Mediawiki 1.15.2Mediawiki Mediawiki 1.15.1Mediawiki Mediawiki 1.15.0Mediawiki Mediawiki 1.13.2Mediawiki Mediawiki 1.13.1Mediawiki Mediawiki 1.12.1Mediawiki Mediawiki 1.12.0Mediawiki Mediawiki 1.20.4Mediawiki Mediawiki 1.20.3Mediawiki Mediawiki 1.19.1Mediawiki Mediawiki 1.19.0Mediawiki Mediawiki 1.18.0Mediawiki Mediawiki 1.18
5
CVSSv2
CVE-2013-2032
MediaWiki prior to 1.19.6 and 1.20.x prior to 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote malicious users to bypass the intended restrictions of an extension that only implem...
Mediawiki Mediawiki 1.19.3Mediawiki Mediawiki 1.19.1Mediawiki Mediawiki 1.18.3Mediawiki Mediawiki 1.18.1Mediawiki Mediawiki 1.18.0Mediawiki Mediawiki 1.17.2Mediawiki Mediawiki 1.17.0Mediawiki Mediawiki 1.16.0Mediawiki Mediawiki 1.15.1Mediawiki Mediawiki 1.15.0Mediawiki Mediawiki 1.14.0Mediawiki Mediawiki 1.13.1Mediawiki Mediawiki 1.13.0Mediawiki Mediawiki 1.12.0Mediawiki Mediawiki 1.11.1Mediawiki Mediawiki 1.10.3Mediawiki Mediawiki 1.10.1Mediawiki Mediawiki 1.10.0Mediawiki Mediawiki 1.19.0Mediawiki Mediawiki 1.19Mediawiki Mediawiki 1.17Mediawiki Mediawiki 1.16.2
4.3
CVSSv2
CVE-2014-2244
Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki prior to 1.19.12, 1.20.x and 1.21.x prior to 1.21.6, and 1.22.x prior to 1.22.3 allows remote malicious users to inject arbitrary web script or HTML via a crafted st...
Mediawiki Mediawiki 1.16.0Mediawiki Mediawiki 1.19Mediawiki Mediawiki 1.19.8Mediawiki Mediawiki 1.12.1Mediawiki Mediawiki 1.17.1Mediawiki Mediawiki 1.13.0Mediawiki Mediawiki 1.20.5Mediawiki Mediawiki 1.14.0Mediawiki Mediawiki 1.20.1Mediawiki Mediawiki 1.11.0Mediawiki Mediawiki 1.17Mediawiki MediawikiMediawiki Mediawiki 1.15.1Mediawiki Mediawiki 1.22.0Mediawiki Mediawiki 1.19.3Mediawiki Mediawiki 1.15.0Mediawiki Mediawiki 1.18Mediawiki Mediawiki 1.19.1Mediawiki Mediawiki 1.12.3Mediawiki Mediawiki 1.15.3Mediawiki Mediawiki 1.12.0Mediawiki Mediawiki 1.21.5
4.3
CVSSv2
CVE-2014-2242
includes/upload/UploadBase.php in MediaWiki prior to 1.19.12, 1.20.x and 1.21.x prior to 1.21.6, and 1.22.x prior to 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote malicious users to conduct cross-site scripting (XSS) attacks via an SVG upload...
Mediawiki Mediawiki 1.16.0Mediawiki Mediawiki 1.19Mediawiki Mediawiki 1.19.8Mediawiki Mediawiki 1.12.1Mediawiki Mediawiki 1.17.1Mediawiki Mediawiki 1.13.0Mediawiki Mediawiki 1.20.5Mediawiki Mediawiki 1.14.0Mediawiki Mediawiki 1.20.1Mediawiki Mediawiki 1.11.0Mediawiki Mediawiki 1.17Mediawiki MediawikiMediawiki Mediawiki 1.15.1Mediawiki Mediawiki 1.22.0Mediawiki Mediawiki 1.19.3Mediawiki Mediawiki 1.15.0Mediawiki Mediawiki 1.18Mediawiki Mediawiki 1.19.1Mediawiki Mediawiki 1.12.3Mediawiki Mediawiki 1.15.3Mediawiki Mediawiki 1.12.0Mediawiki Mediawiki 1.21.5
5.8
CVSSv2
CVE-2014-2243
includes/User.php in MediaWiki prior to 1.19.12, 1.20.x and 1.21.x prior to 1.21.6, and 1.22.x prior to 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote malicious users to obtain access via a brute-forc...
Mediawiki Mediawiki 1.16.0Mediawiki Mediawiki 1.19Mediawiki Mediawiki 1.19.8Mediawiki Mediawiki 1.12.1Mediawiki Mediawiki 1.17.1Mediawiki Mediawiki 1.13.0Mediawiki Mediawiki 1.20.5Mediawiki Mediawiki 1.14.0Mediawiki Mediawiki 1.20.1Mediawiki Mediawiki 1.11.0Mediawiki Mediawiki 1.17Mediawiki MediawikiMediawiki Mediawiki 1.15.1Mediawiki Mediawiki 1.22.0Mediawiki Mediawiki 1.19.3Mediawiki Mediawiki 1.15.0Mediawiki Mediawiki 1.18Mediawiki Mediawiki 1.19.1Mediawiki Mediawiki 1.12.3Mediawiki Mediawiki 1.15.3Mediawiki Mediawiki 1.12.0Mediawiki Mediawiki 1.21.5
5
CVSSv2
CVE-2012-1581
MediaWiki 1.17.x prior to 1.17.3 and 1.18.x prior to 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote malicious users to change the passwords of arbitrary users.
Mediawiki Mediawiki 1.17.2Mediawiki Mediawiki 1.17Mediawiki Mediawiki 1.17.0Mediawiki Mediawiki 1.17.1Mediawiki Mediawiki 1.18.0Mediawiki Mediawiki 1.18.1Mediawiki Mediawiki 1.18
5
CVSSv2
CVE-2012-1579
The resource loader in MediaWiki 1.17.x prior to 1.17.3 and 1.18.x prior to 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote malicious users to obtain sensitive information.
Mediawiki Mediawiki 1.17Mediawiki Mediawiki 1.17.0Mediawiki Mediawiki 1.17.2Mediawiki Mediawiki 1.17.1Mediawiki Mediawiki 1.18Mediawiki Mediawiki 1.18.0Mediawiki Mediawiki 1.18.1
6.8
CVSSv2
CVE-2012-1580
Cross-site request forgery (CSRF) vulnerability in Special:Upload in MediaWiki 1.17.x prior to 1.17.3 and 1.18.x prior to 1.18.2 allows remote malicious users to hijack the authentication of unspecified victims for requests that upload files.
Mediawiki Mediawiki 1.17Mediawiki Mediawiki 1.17.0Mediawiki Mediawiki 1.17.2Mediawiki Mediawiki 1.17.1Mediawiki Mediawiki 1.18.0Mediawiki Mediawiki 1.18Mediawiki Mediawiki 1.18.1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48654CVE-2024-2757authentication bypassCVE-2024-3194CVE-2024-33640CVE-2024-21111dosinsecure direct object referenceCVE-2024-21345
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook