mediawiki vulnerabilities (Debian)
300 vulnerabilities.
-
mediawikiDebian [Unknown description] No score -
mediawikiDebian [Unknown description] No score -
mediawikiDebian [Unknown description] No score -
mediawikiDebian [Unknown description] No score -
mediawikiDebian [Unknown description] No score -
mediawikiDebian [Unknown description] No score -
mediawikiDebian [Unknown description] No score -
mediawikiDebian [Unknown description] No score -
mediawikiDebian [Unknown description] No score -
mediawikiDebian Remote Code Execution via Unsafe Deserialization in LogItem Import 5.9 Medium -
mediawikiDebian Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata 5.3 Medium -
mediawikiDebian Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets 0.0 None -
mediawikiDebian $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces 0.0 None -
mediawikiDebian QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI 5.3 Medium -
mediawikiDebian SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute 5.3 Medium -
mediawikiDebian mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html 5.3 Medium -
mediawikiDebian "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted 5.3 Medium -
mediawikiDebian Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input 0.0 None -
mediawikiDebian API identification of users on private wikis 5.1 Medium -
mediawikiDebian Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation... 2.3 Low -
mediawikiDebian action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request 0.0 None -
mediawikiDebian Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix 2.0 Low -
mediawikiDebian Special:UserRights allows viewing user rights from private wiki 1.1 Low -
mediawikiDebian Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP 2.1 Low -
mediawikiDebian User localization leaked by AbuseFilter + EventStream 5.5 Medium -
mediawikiDebian RecentChanges entries expose suppressed content via generated log page html 1.3 Low -
mediawikiDebian Users API leaks whether privileged users have their user groups disabled for lack of 2FA 5.1 Medium -
mediawikiDebian AbuseFilter misuses ::userCanBitfield, exposing access-controlled information 2.1 Low -
mediawikiDebian Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels 0.0 None -
mediawikiDebian Stored XSS through a system message in Special:ApiSandbox 0.0 None -
mediawikiDebian UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanks 0.0 None -
mediawikiDebian Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')... 0.0 None -
mediawikiDebian Action API discussiontoolspageinfo does not check for authorizeRead for the page 2.7 Low -
mediawikiDebian Stored XSS through system messages in MW Core 0.0 None -
mediawikiDebian Stored XSS through system messages provided to CodexHtmlForms 0.0 None -
mediawikiDebian HTML rest endpoint needs PoolCounter and proper parser cache check 0.0 None -
mediawikiDebian Codex Special:Block vulnerable to message key XSS 0.0 None -
mediawikiDebian With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList 2.1 Low -
mediawikiDebian Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog 2.1 Low -
mediawikiDebian Vector inserts portlet labels as HTML, allowing for stored XSS through system messages 0.0 None -
mediawikiDebian Autoblocks from global account suppressions are publicly visible 2.3 Low -
mediawikiDebian DiscussionTools should use better regex 8.8 High -
mediawikiDebian Action API xslt option allows JavaScript execution by administrators who are not interface administrators 0.0 None -
mediawikiDebian Lua segfault in unpack() 1.7 Low -
mediawikiDebian mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does 0.0 None -
mediawikiDebian list=allrevisions can be used to bypass Extension:Lockdown 0.0 None -
mediawikiDebian Magic word replacement in legacy parser allows using reserved data attributes through wikitext 0.0 None -
mediawikiDebian Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn" 0.0 None -
mediawikiDebian Stored XSS through edit summaries in MW Core 0.0 None -
mediawikiDebian XSS when pasting into VE 0.0 None - Show olderLoading…