Skip to contentMediawiki vulnerabilities
Newest
- mediawikiMediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1)...CVE-2012-4381Fix available8.1 High
- mediawikiThe CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1...CVE-2013-64555.3 Medium
- mediawiki, scribunto +1 moreThe Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and...CVE-2014-94815.9 Medium
- mediawikiThe WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax...CVE-2020-6163Fix available6.1 Medium
- mediawikiThe MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles...CVE-2019-199106.1 Medium
- mediawiki visual editorThe VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an...CVE-2019-197086.1 Medium
- mediawiki, debian linux +1 morePossible to circumvent title-blacklistCVE-2019-19709Fix available6.1 Medium
- mediawiki, debian linux, fedoraproject fedora +1 more +3 moreMediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which...CVE-2013-1817Fix available7.5 High
- mediawiki, debian linux, fedoraproject fedora +1 more +3 moreMediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of...CVE-2013-1816Fix available7.5 High
- mediawiki abusefilterAn issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific...CVE-2019-189875.3 Medium
- ikimedia foundation mediawiki, debian linux +1 moreA cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4...CVE-2013-1951Fix available6.1 Medium
- mediawiki checkuserAn issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive...CVE-2019-186116.5 Medium
- mediawiki abusefilterAn issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Previously...CVE-2019-186125.3 Medium
- mediawikimediawiki allows deleted text to be exposedCVE-2012-0046Fix available7.5 High
- mediawiki, debian linux, fedoraproject fedora +2 moreMediaWiki information disclosureCVE-2019-16738Fix available5.3 Medium
- mediawiki mobilefrontendIn the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit...CVE-2019-148076.1 Medium
- mediawiki, debian linux +1 moreWikimedia information leak vulnerabilityCVE-2019-12474Fix available7.5 High
- mediawiki, debian linux +1 moreWikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultipleCVE-2019-12473Fix available7.5 High
- mediawikiMediaWiki Incorrect Access Control vulnerabilityCVE-2019-12472Fix available7.5 High
- mediawiki, debian linux +1 moreMediaWiki Cross-site Scripting (XSS)CVE-2019-12471Fix available6.1 Medium
- mediawiki, debian linux +1 moreWikimedia MediaWik exposed suppressed log in RevisionDelete pageCVE-2019-12470Fix available6.5 Medium
- mediawiki, debian linux +1 moreMediaWiki Incorrect Access Control vulnerabilityCVE-2019-12469Fix available6.5 Medium
- mediawiki, debian linux +1 moreWikimedia MediaWiki Incorrect Access Control vulnerabilityCVE-2019-12468Fix available9.8 Critical
- mediawiki, debian linux +1 moreMediaWiki Incorrect Access Control vulnerabilityCVE-2019-12467Fix available5.3 Medium
- mediawiki, debian linux +1 moreWikimedia MediaWiki allows CSRFCVE-2019-12466Fix available8.8 High
- mediawikiTarball was missing .htaccess filesCVE-2018-13258Fix available5.3 Medium
- mediawiki, debian linux +1 moreBotPasswords can bypass CentralAuth's account lockCVE-2018-0505Fix available6.5 Medium
- mediawiki, debian linux +1 moreInformation disclosure in Special:Redirect/logidCVE-2018-0504Fix available6.5 Medium
- mediawiki, debian linux +1 more$wgRateLimits entry for 'user' overrides 'newbie'CVE-2018-0503Fix available4.3 Medium
- mediawikiMediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to...CVE-2014-16865.3 Medium
- mediawiki, debian linux, mediawiki (syntaxhighlight extension) +2 moreParameters injection in SyntaxHighlight results in multiple vulnerabilitiesCVE-2017-0372Public exploitFix availableEPSS 11.3%9.8 Critical
- mediawiki, debian linux +1 moreHaving LocalisationCache directory default to system tmp directory is insecureCVE-2017-0367Fix available8.8 High
- mediawiki, fedoraproject fedora +1 moreThe OAuth extension for MediaWiki improperly negotiates a new client token only over Special...CVE-2015-80087.5 High
- mediawiki, debian linux +1 moreThe language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2...CVE-2017-8815Fix available7.5 High
- mediawiki, debian linux +1 moreThe language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2...CVE-2017-8814Fix available7.5 High
- mediawiki, debian linux +1 moreMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers...CVE-2017-8812Fix available5.3 Medium
- mediawiki, debian linux +1 moreThe implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1...CVE-2017-8811Fix available6.1 Medium
- mediawiki, debian linux +1 moreMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is...CVE-2017-8810Fix available7.5 High
- mediawiki, debian linux +1 moreapi.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a...CVE-2017-8809Public exploitFix available9.8 Critical
- mediawiki, debian linux +1 moreMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the ...CVE-2017-8808Fix available6.1 Medium
- mediawikiMultiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before...CVE-2012-4378Fix available6.1 Medium
- mediawikiCross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2...CVE-2012-4377Fix available6.1 Medium
- mediawikiMediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata,...CVE-2012-4382Fix available4.9 Medium
- mediawikiMediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass...CVE-2012-4380Fix available7.5 High
- mediawikiMediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options...CVE-2012-4379Fix available6.5 Medium
- mediawikiThe getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote...CVE-2014-94879.8 Critical
- mediawikiThe MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3...CVE-2015-80099.8 Critical
- mediawikiMediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access...CVE-2016-6337Fix available7.5 High
- mediawiki, debian linux +1 moreSpam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameterCVE-2017-0370Fix available5.3 Medium
- mediawiki, debian linux +1 moreSysops can undelete pages, although the page is protected against itCVE-2017-0369Fix available6.5 Medium
- Show moreLoading…