Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

mediawiki mediawiki 1.24.1 vulnerabilities and exploits

(subscribe to this query)
7.1
CVSSv2
CVE-2015-2936
MediaWiki 1.24.x prior to 1.24.2, when using PBKDF2 for password hashing, allows remote malicious users to cause a denial of service (CPU consumption) via a long password.
Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1
4.3
CVSSv2
CVE-2015-6729
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki prior to 1.23.10, 1.24.x prior to 1.24.3, and 1.25.x prior to 1.25.2 allows remote malicious users to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page.
Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.0
4.3
CVSSv2
CVE-2015-6730
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki prior to 1.23.10, 1.24.x prior to 1.24.3, and 1.25.x prior to 1.25.2 allows remote malicious users to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, relate...
Mediawiki MediawikiMediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2
5
CVSSv2
CVE-2015-6733
GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki prior to 1.23.10, 1.24.x prior to 1.24.3, and 1.25.x prior to 1.25.2, allows remote malicious users to cause a denial of service (resource consumption) via unspecified vectors.
Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki
4.3
CVSSv2
CVE-2015-6734
Cross-site scripting (XSS) vulnerability in contrib/cssgen.php in the GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki prior to 1.23.10, 1.24.x prior to 1.24.3, and 1.25.x prior to 1.25.2, allows remote malicious users to inject arbitrary web script or HTML via...
Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.1Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2
6.8
CVSSv2
CVE-2015-8623
The User::matchEditToken function in includes/User.php in MediaWiki prior to 1.23.12 and 1.24.x prior to 1.24.5 does not perform token comparison in constant time before returning, which allows remote malicious users to guess the edit token and bypass CSRF protection via a timing...
Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.24.4Mediawiki Mediawiki 1.24.3
7.5
CVSSv2
CVE-2015-6728
The ApiBase::getWatchlistUser function in MediaWiki prior to 1.23.10, 1.24.x prior to 1.24.3, and 1.25.x prior to 1.25.2 does not perform token comparison in constant time, which allows remote malicious users to guess the watchlist token and bypass CSRF protection via a timing at...
Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.0
4
CVSSv2
CVE-2015-8004
MediaWiki prior to 1.23.11, 1.24.x prior to 1.24.4, and 1.25.x prior to 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which ret...
Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.2
3.5
CVSSv2
CVE-2015-8001
The chunked upload API (ApiUpload) in MediaWiki prior to 1.23.11, 1.24.x prior to 1.24.4, and 1.25.x prior to 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the fil...
Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.2
6.8
CVSSv2
CVE-2015-8002
The chunked upload API (ApiUpload) in MediaWiki prior to 1.23.11, 1.24.x prior to 1.24.4, and 1.25.x prior to 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.
Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.2Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.2Mediawiki MediawikiMediawiki Mediawiki 1.24.1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463CVE-2024-3400deserializationCVE-2024-21788CVE-2023-42433CVE-2024-21841CVE-2024-22095local file inclusionmemory leak
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook