Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

mediawiki mediawiki 1.24.2 vulnerabilities and exploits

(subscribe to this query)
9.8
CVSSv3
CVE-2015-8009
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x prior to 1.25.3, 1.24.x prior to 1.24.4, and prior to 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use an...
Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.0Mediawiki MediawikiMediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.2
9.8
CVSSv3
CVE-2015-8626
The User::randomPassword function in MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote malicious users to obtain access via a brute-for...
Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.24.4Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.3Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.2
8.8
CVSSv3
CVE-2015-8624
The User::matchEditToken function in includes/User.php in MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which al...
Mediawiki Mediawiki 1.24.4Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.25.2Mediawiki Mediawiki 1.25.3Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.1
8.8
CVSSv3
CVE-2015-8623
The User::matchEditToken function in includes/User.php in MediaWiki prior to 1.23.12 and 1.24.x prior to 1.24.5 does not perform token comparison in constant time before returning, which allows remote malicious users to guess the edit token and bypass CSRF protection via a timing...
Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.24.4Mediawiki Mediawiki 1.24.3
7.5
CVSSv3
CVE-2015-8625
MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote malicious users to read arbitrary files via an @ (at sign) character in unspecified POST a...
Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.2Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.25.3Mediawiki MediawikiMediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.4Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.2
6.1
CVSSv3
CVE-2015-8622
Cross-site scripting (XSS) vulnerability in MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as de...
Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.24.4Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.3Mediawiki MediawikiMediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.2
5.3
CVSSv3
CVE-2015-8627
MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote malicious users to bypass intended access restrictions by using an IP address that...
Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.2Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.25.3Mediawiki Mediawiki 1.24.4Mediawiki MediawikiMediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.3
5.3
CVSSv3
CVE-2015-8628
The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1 allow remote malicious users to obtain sens...
Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.24.4Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.1Mediawiki MediawikiMediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.25.3Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.25.2Mediawiki Mediawiki 1.26.0
NA
CVE-2015-8003
MediaWiki prior to 1.23.11, 1.24.x prior to 1.24.4, and 1.25.x prior to 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads.
Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.2Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.3Mediawiki MediawikiMediawiki Mediawiki 1.24.0
NA
CVE-2015-8001
The chunked upload API (ApiUpload) in MediaWiki prior to 1.23.11, 1.24.x prior to 1.24.4, and 1.25.x prior to 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the fil...
Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.2
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-23316SQL injectiontype confusionCVE-2024-20697CVE-2024-4344localCVE-2024-30043CVE-2024-3821CVE-2024-5041
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook