mediawiki mediawiki 1.22.14 vulnerabilities and exploits

(subscribe to this query)

3.5

CVSSv2

Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki prior to 1.19.23, 1.2x prior to 1.22.15, 1.23.x prior to 1.23.8, and 1.24.x prior to 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.

5

CVSSv2

MediaWiki 1.2x prior to 1.22.15, 1.23.x prior to 1.23.8, and 1.24.x prior to 1.24.1 allows remote malicious users to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.ev...

2.6

CVSSv2

Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote malicious users to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page.

4.3

CVSSv2

Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 allows remote malicious users to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data:...

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 allows remote malicious users to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language varian...

5

CVSSv2

MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 allows remote malicious users to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook