mediawiki vulnerabilities (Debian)
300 vulnerabilities.
mediawikiDebianStored XSS through system messages in VisualEditor0.0 NonemediawikiDebianExtension:TextExtracts does not check for authorizeRead when returning extracts2.7 LowmediawikiDebianWatchlist group mode reveals authors of edits with hidden authorship1.2 LowmediawikiDebianEventStreams publishes suppressed recent change entries that are suppressed from their creation2.7 LowmediawikiDebianAPI list=allpages with maxsize is making really slow queries1.7 LowmediawikiDebianStored XSS through system messages in Special:RecentChangesLinked (MW Core)0.0 NonemediawikiDebianSuppressed blocked IP is visible in Special:BlockList, RC, and other places1.7 LowmediawikiDebianSanitizer::validateAttributes data-XSS0.0 NonemediawikiDebianAdd rate limiting to ApiFancyCaptchaReload0.0 NonemediawikiDebianStored i18n XSS exposed by security patch for T4020770.0 NonemediawikiDebianReauth for enabling 2FA can be bypassed by submitting a form0.0 NonemediawikiDebianSecurity Authentication Bypass in CentralAuth8.8 HighmediawikiDebianMediaWiki should not consider autocreation as login for the purposes of security reauthentication0.0 NonemediawikiDebianImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...0.0 NonemediawikiDebianXSS in Special:ApiSandbox0.0 NonemediawikiDebian"{{SITENAME}} registered email address has been changed" email sent to unverified email addresses2.1 LowmediawikiDebianHTML injection in API action=feedcontributions output from i18n message0.0 NonemediawikiDebianComplete content leak of private wikis due to PasswordReset Wikitext injection in error message4.6 MediummediawikiDebianHTML injection in feed output from i18n message6.9 MediummediawikiDebianAbuseFilter log interfaces expose global private and hidden filters when central DB is not available2.3 LowmediawikiDebianPotential javascript injection attack enabled by Unicode normalization in Action API2.1 LowmediawikiDebianLogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions2.1 LowmediawikiDebianCascading protection is not preventing file reversions0.0 NonemediawikiDebian"reupload-own" restriction can be bypassed by reverting file0.0 NonemediawikiDebiani18n XSS vulnerability in HTMLMultiSelectField when sections are used0.0 NonemediawikiDebianImproper permissions handling in MediaWiki AbuseFilter5.3 MediummediawikiDebianAn issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7...7.4 HighmediawikiDebianAn issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki...6.1 MediummediawikiDebianAn issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x...6.5 MediummediawikiDebianAn issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40...7.5 HighmediawikiDebianAn issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1...6.1 MediummediawikiDebianAn issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39...4.3 MediummediawikiDebianAn issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1...5.4 MediummediawikiDebianAn issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1...5.3 MediummediawikiDebianMediaWiki Denial of Service vulnerability7.5 HighmediawikiDebianStored XSS leads to privilege escalation in MediaWiki v1.40.07.3 HighmediawikiDebianAn issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x...5.3 MediummediawikiDebianAn issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x...6.1 MediummediawikiDebianAn issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x...4.3 MediummediawikiDebianX-Forwarded-For header allows brute-forcing autoblocked IP addresses9.8 CriticalmediawikiDebianAn issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39...5.5 MediummediawikiDebianAn issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x...5.3 MediummediawikiDebianAn issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x...5.3 MediummediawikiDebianAn issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions...6.1 MediummediawikiDebianAn issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x...6.1 MediummediawikiDebianChange in port should be considered a change in origin in Guzzle7.7 HighmediawikiDebianCURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle7.7 HighmediawikiDebianFix failure to strip Authorization header on HTTP downgrade in Guzzle7.5 HighmediawikiDebianFailure to strip the Cookie header on change in host or HTTP downgrade in Guzzle7.5 HighmediawikiDebianCross-domain cookie leakage in Guzzle8.0 High- Show moreLoading…