mediawiki vulnerabilities (Ubuntu)
198 vulnerabilities.
mediawikiUbuntuHTML rest endpoint needs PoolCounter and proper parser cache check0.0 NonemediawikiUbuntuCodex Special:Block vulnerable to message key XSS0.0 NonemediawikiUbuntuWith MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList2.1 LowmediawikiUbuntuCreating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog2.1 LowmediawikiUbuntuVector inserts portlet labels as HTML, allowing for stored XSS through system messages0.0 NonemediawikiUbuntuAutoblocks from global account suppressions are publicly visible2.3 LowmediawikiUbuntuDiscussionTools should use better regex8.8 HighmediawikiUbuntuAction API xslt option allows JavaScript execution by administrators who are not interface administrators0.0 NonemediawikiUbuntuLua segfault in unpack()1.7 LowmediawikiUbuntumw.message(…).parse() doesn't output safe HTML, but it's being used as if it does0.0 NonemediawikiUbuntulist=allrevisions can be used to bypass Extension:Lockdown0.0 NonemediawikiUbuntuMagic word replacement in legacy parser allows using reserved data attributes through wikitext0.0 NonemediawikiUbuntuWrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"0.0 NonemediawikiUbuntuStored XSS through edit summaries in MW Core0.0 NonemediawikiUbuntuXSS when pasting into VE0.0 NonemediawikiUbuntuStored XSS through system messages in VisualEditor0.0 NonemediawikiUbuntuExtension:TextExtracts does not check for authorizeRead when returning extracts2.7 LowmediawikiUbuntuWatchlist group mode reveals authors of edits with hidden authorship1.2 LowmediawikiUbuntuEventStreams publishes suppressed recent change entries that are suppressed from their creation2.7 LowmediawikiUbuntuAPI list=allpages with maxsize is making really slow queries1.7 LowmediawikiUbuntuStored XSS through system messages in Special:RecentChangesLinked (MW Core)0.0 NonemediawikiUbuntuSuppressed blocked IP is visible in Special:BlockList, RC, and other places1.7 LowmediawikiUbuntuSanitizer::validateAttributes data-XSS0.0 NonemediawikiUbuntuAdd rate limiting to ApiFancyCaptchaReload0.0 NonemediawikiUbuntuStored i18n XSS exposed by security patch for T4020770.0 NonemediawikiUbuntuReauth for enabling 2FA can be bypassed by submitting a form0.0 NonemediawikiUbuntuThe compare API module breaks Extension:Lockdown10.0 CriticalmediawikiUbuntuStored XSS through system messages6.9 MediummediawikiUbuntuStored XSS through system messages6.9 MediummediawikiUbuntuStored XSS through a system message6.9 MediummediawikiUbuntuStored XSS through system messages6.9 MediummediawikiUbuntuMultiple critical security issues in Springboard6.9 MediummediawikiUbuntuSpecial:Translate tool does not use the correct IP and User-Agent in the CheckUser tool6.9 MediummediawikiUbuntuSQL injection in WatchAnalytics through Special:ClearPendingReviews7.5 HighmediawikiUbuntuStored XSS through system messages in PageForms5.8 MediummediawikiUbuntuGlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS5.8 MediummediawikiUbuntuImproperly sanitized style parameter in LanguageSelector8.8 HighmediawikiUbuntuStored XSS through system messages in ExternalGuidance6.9 MediummediawikiUbuntuStored XSS through a system message in MultiBoilerplate6.9 MediummediawikiUbuntuStored XSS through system messages in LastModified6.9 MediummediawikiUbuntuBucket vulnerable to infinite recursion when querying a bucket using the != operator6.5 MediummediawikiUbuntuSecurity Authentication Bypass in CentralAuth8.8 HighmediawikiUbuntuMediaWiki should not consider autocreation as login for the purposes of security reauthentication0.0 NonemediawikiUbuntuImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...0.0 NonemediawikiUbuntuXSS in Special:ApiSandbox0.0 NonemediawikiUbuntu"{{SITENAME}} registered email address has been changed" email sent to unverified email addresses2.1 LowmediawikiUbuntuHTML injection in API action=feedcontributions output from i18n message0.0 NonemediawikiUbuntuComplete content leak of private wikis due to PasswordReset Wikitext injection in error message4.6 MediummediawikiUbuntuHTML injection in feed output from i18n message6.9 MediummediawikiUbuntuAbuseFilter log interfaces expose global private and hidden filters when central DB is not available2.3 Low- Show moreLoading…