Mediawiki

Mediawiki

395 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2017-8815

  • EPSS 0.4%
  • Veröffentlicht 15.11.2017 08:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.

6.1

CVE-2012-4377

  • EPSS 1%
  • Veröffentlicht 26.10.2017 20:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.

6.1

CVE-2012-4378

  • EPSS 0.51%
  • Veröffentlicht 26.10.2017 20:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index...

6.5

CVE-2012-4379

  • EPSS 0.43%
  • Veröffentlicht 19.10.2017 21:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.

7.5

CVE-2012-4380

  • EPSS 0.55%
  • Veröffentlicht 19.10.2017 21:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.

4.9

CVE-2012-4382

  • EPSS 0.29%
  • Veröffentlicht 19.10.2017 21:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt.

9.8

CVE-2014-9487

  • EPSS 1.01%
  • Veröffentlicht 17.10.2017 14:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2...

9.8

CVE-2015-8009

Exploit
  • EPSS 0.34%
  • Veröffentlicht 25.07.2017 14:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote regist...

7.5

CVE-2016-6331

  • EPSS 0.17%
  • Veröffentlicht 20.04.2017 17:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.

7.5

CVE-2016-6332

  • EPSS 0.22%
  • Veröffentlicht 20.04.2017 17:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.