mediawiki mediawiki 1.22.15 vulnerabilities and exploits

(subscribe to this query)

MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2, when using HHVM, allows remote malicious users to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF fi...

Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 allows remote malicious users to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data:...

Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 allows remote malicious users to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language varian...

MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote malicious users to inject arbitrary web script or HTML via a crafted SVG file.

MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 allows remote malicious users to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."

MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2, when using HHVM or Zend PHP, allows remote malicious users to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long r...

Cross-site scripting (XSS) vulnerability in MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 allows remote malicious users to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file.

Cross-site scripting (XSS) vulnerability in MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2, when using HHVM, allows remote malicious users to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is n...

MediaWiki 1.2x prior to 1.22.15, 1.23.x prior to 1.23.8, and 1.24.x prior to 1.24.1 allows remote malicious users to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.ev...

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook