mediawiki mediawiki 1.39.0 vulnerabilities and exploits

(subscribe to this query)

An issue exists in the CheckUser extension for MediaWiki up to and including 1.39.x. Various components of this extension can expose information on the performer of edits and logged actions. This information should not allow public viewing: it is supposed to be viewable only by u...

Mediawiki Mediawiki 1.39.0 Mediawiki Mediawiki 1.39.1

An issue exists in MediaWiki prior to 1.35.9, 1.36.x up to and including 1.38.x prior to 1.38.5, and 1.39.x prior to 1.39.1. There is XSS in Wikibase date formatting via wikibase-time-precision-* fields. This allows JavaScript execution by staff/admin users who do not intentional...

Mediawiki Mediawiki Mediawiki Mediawiki 1.39.0

An issue exists in MediaWiki prior to 1.35.9, 1.36.x up to and including 1.38.x prior to 1.38.5, and 1.39.x prior to 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decrypt.

Mediawiki Mediawiki Mediawiki Mediawiki 1.39.0

An issue exists in MediaWiki prior to 1.35.9, 1.36.x up to and including 1.38.x prior to 1.38.5, and 1.39.x prior to 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to loc...

Mediawiki Mediawiki Mediawiki Mediawiki 1.39.0 Fedoraproject Fedora 37

An issue exists in MediaWiki prior to 1.35.9, 1.36.x up to and including 1.38.x prior to 1.38.5, and 1.39.x prior to 1.39.1. SpecialMobileHistory allows remote malicious users to cause a denial of service because database queries are slow.

Mediawiki Mediawiki Mediawiki Mediawiki 1.39.0 Fedoraproject Fedora 37

An issue exists in MediaWiki prior to 1.35.9, 1.36.x up to and including 1.38.x prior to 1.38.5, and 1.39.x prior to 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an...

Mediawiki Mediawiki Mediawiki Mediawiki 1.39.0 Fedoraproject Fedora 37

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook