Browse CVEs

MEDIUM 6.5 CVE-2016-6336 MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intend… Mediawiki after 1.23.14 Fix from $1,6002017-04-20 MEDIUM 6.1 CVE-2016-6333 Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before… Mediawiki after 1.23.14 Fix from $1,6002017-04-20 MEDIUM 6.1 CVE-2016-6334 Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x be… Mediawiki after 1.23.14 Fix from $1,6002017-04-20 CRITICAL 9.8 CVE-2015-8626 The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwor… Mediawiki after 1.23.11 Fix from $2,3002017-03-23 HIGH 8.8 CVE-2015-8623 The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in cons… Mediawiki after 1.23.11 Fix from $1,9502017-03-23 HIGH 8.8 CVE-2015-8624 The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.2… Mediawiki after 1.23.11 Fix from $1,9502017-03-23 HIGH 7.5 CVE-2015-8625 MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the c… Mediawiki after 1.23.11 Fix from $1,9502017-03-23 MEDIUM 6.1 CVE-2015-8622 Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is c… Mediawiki after 1.23.11 Fix from $1,6002017-03-23 MEDIUM 5.3 CVE-2015-8627 MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero… Mediawiki after 1.23.11 Fix from $1,6002017-03-23 MEDIUM 5.3 CVE-2015-8628 The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki befor… Mediawiki after 1.23.11 Fix from $1,6002017-03-23 MEDIUM 5.0 CVE-2015-8005 MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote at… Mediawiki after 1.23.10 Fix from $1,6002015-11-09 MEDIUM 6.8 CVE-2015-8003 MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to h… Mediawiki after 1.23.10 Fix from $1,6002015-11-09 MEDIUM 6.8 CVE-2015-8002 The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to c… Mediawiki after 1.23.10 Fix from $1,6002015-11-09 MEDIUM 5.0 CVE-2015-6733 GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote att… Mediawiki after 1.23.9 Fix from $1,6002015-09-01 HIGH 7.5 CVE-2015-6728 The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison … Mediawiki after 1.23.9 Fix from $1,9502015-09-01 MEDIUM 5.0 CVE-2013-7444 The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text. Mediawiki after 1.22.0 Fix from $1,6002015-09-01 HIGH 7.1 CVE-2015-2942 MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU an… Mediawiki after 1.19.23 Fix from $1,9502015-04-13 MEDIUM 6.8 CVE-2015-2940 Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of cert… Checkuser Patch available Fix from $1,6002015-04-13 HIGH 7.1 CVE-2015-2937 MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of ser… Mediawiki after 1.19.23 Fix from $1,9502015-04-13 HIGH 7.1 CVE-2015-2936 MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a … Mediawiki Patch available Fix from $1,9502015-04-13 MEDIUM 5.0 CVE-2015-2935 MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user … Mediawiki after 1.19.23 Fix from $1,6002015-04-13 MEDIUM 5.0 CVE-2014-9476 MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAX… Mediawiki after 1.19.22 Fix from $1,6002015-01-16 HIGH 7.5 CVE-2014-9277 The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 all… Mediawiki after 1.19.21 Fix from $1,9502015-01-04 MEDIUM 5.1 CVE-2014-9276 Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.… Mediawiki after 1.19.21 Fix from $1,6002015-01-04 MEDIUM 6.8 CVE-2014-5241 The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accep… Mediawiki after 1.19.17 Fix from $1,6002014-08-22 MEDIUM 5.0 CVE-2013-1818 maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors. Mediawiki after 1.20.2 Fix from $1,6002014-06-02 MEDIUM 6.8 CVE-2012-5391 Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attacker… Mediawiki after 1.18.5 Fix from $1,6002014-06-02 MEDIUM 6.8 CVE-2012-5395 Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote… Mediawiki after 1.18.5 Fix from $1,6002014-06-02 MEDIUM 6.8 CVE-2014-3454 Cross-site request forgery (CSRF) vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.… Mediawiki after 1.19.9 Fix from $1,6002014-05-12 MEDIUM 6.8 CVE-2014-3455 Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4) CreateClass special… Mediawiki after 1.19.9 Fix from $1,6002014-05-12