Mediawiki

Mediawiki

378 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2015-8624

  • EPSS 0.12%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message shou...

7.5

CVE-2015-8625

  • EPSS 0.31%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in un...

9.8

CVE-2015-8626

  • EPSS 0.64%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access...

5.3

CVE-2015-8627

  • EPSS 0.43%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an...

5.3

CVE-2015-8628

  • EPSS 0.44%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attacker...

5

CVE-2015-8005

  • EPSS 0.25%
  • Veröffentlicht 09.11.2015 18:59:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file.

4

CVE-2015-8004

  • EPSS 0.16%
  • Veröffentlicht 09.11.2015 18:59:03
  • Zuletzt bearbeitet 12.04.2025 10:46:40

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revision...

6.8

CVE-2015-8003

  • EPSS 0.52%
  • Veröffentlicht 09.11.2015 18:59:02
  • Zuletzt bearbeitet 12.04.2025 10:46:40

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads.

6.8

CVE-2015-8002

  • EPSS 0.52%
  • Veröffentlicht 09.11.2015 18:59:01
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.

3.5

CVE-2015-8001

  • EPSS 0.32%
  • Veröffentlicht 09.11.2015 18:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a ch...