Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
mediawiki mediawiki vulnerabilities and exploits
(subscribe to this query)
8.8
CVSSv3
CVE-2019-12466
Wikimedia MediaWiki up to and including 1.32.1 allows CSRF.
Mediawiki Mediawiki
Debian Debian Linux 9.0
8.8
CVSSv3
CVE-2017-0367
Mediawiki prior to 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.
Mediawiki Mediawiki
Debian Debian Linux 7.0
8.8
CVSSv3
CVE-2017-0362
Mediawiki prior to 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.
Mediawiki Mediawiki
Debian Debian Linux 7.0
8.8
CVSSv3
CVE-2015-8624
The User::matchEditToken function in includes/User.php in MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which al...
Mediawiki Mediawiki 1.24.4
Mediawiki Mediawiki
Mediawiki Mediawiki 1.24.0
Mediawiki Mediawiki 1.24.1
Mediawiki Mediawiki 1.25.2
Mediawiki Mediawiki 1.25.3
Mediawiki Mediawiki 1.24.2
Mediawiki Mediawiki 1.25.0
Mediawiki Mediawiki 1.26.0
Mediawiki Mediawiki 1.24.3
Mediawiki Mediawiki 1.25.1
8.8
CVSSv3
CVE-2015-8623
The User::matchEditToken function in includes/User.php in MediaWiki prior to 1.23.12 and 1.24.x prior to 1.24.5 does not perform token comparison in constant time before returning, which allows remote malicious users to guess the edit token and bypass CSRF protection via a timing...
Mediawiki Mediawiki
Mediawiki Mediawiki 1.24.0
Mediawiki Mediawiki 1.24.1
Mediawiki Mediawiki 1.24.2
Mediawiki Mediawiki 1.24.4
Mediawiki Mediawiki 1.24.3
8.1
CVSSv3
CVE-2022-29248
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a ...
Guzzlephp Guzzle
Drupal Drupal
Debian Debian Linux 11.0
8.1
CVSSv3
CVE-2012-4381
MediaWiki prior to 1.18.5, and 1.19.x prior to 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent malicious users to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the st...
Mediawiki Mediawiki
7.8
CVSSv3
CVE-2020-1709
A vulnerability was found in all openshift/mediawiki 4.x.x versions before 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/mediawiki. An attacker with access to the container could use this flaw to modify /etc/passwd and esca...
Redhat Openshift 3.11
Redhat Openshift
7.8
CVSSv3
CVE-2019-19345
A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions before 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mediawiki-apb. An attacker with access to the container could use this flaw to modify /e...
Redhat Openshift 3.11
Redhat Openshift
7.8
CVSSv3
CVE-2017-0361
Mediawiki prior to 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.
Mediawiki Mediawiki
Debian Debian Linux 7.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-22120
CVE-2024-35921
CVE-2024-35874
brute force
CVE-2024-36080
unprivileged
CVE-2024-35917
IDOR
CVE-2024-4947
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »