Mediawiki

Mediawiki

395 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2016-6333

  • EPSS 0.34%
  • Veröffentlicht 20.04.2017 17:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:My...

6.1

CVE-2016-6334

  • EPSS 0.22%
  • Veröffentlicht 20.04.2017 17:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving repl...

7.5

CVE-2016-6335

  • EPSS 0.27%
  • Veröffentlicht 20.04.2017 17:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php.

6.5

CVE-2016-6336

  • EPSS 0.11%
  • Veröffentlicht 20.04.2017 17:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitr...

7.5

CVE-2016-6337

  • EPSS 0.34%
  • Veröffentlicht 20.04.2017 17:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.

6.1

CVE-2015-8622

  • EPSS 0.3%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HT...

8.8

CVE-2015-8623

  • EPSS 0.13%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF pro...

8.8

CVE-2015-8624

  • EPSS 0.12%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message shou...

7.5

CVE-2015-8625

  • EPSS 0.31%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in un...

9.8

CVE-2015-8626

  • EPSS 0.64%
  • Veröffentlicht 23.03.2017 20:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access...