Vulnerabilities (CVE)

Filtered by vendor Mediawiki Subscribe
Total 374 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-37302 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 6.1 MEDIUM
An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).
CVE-2022-4561 1 Mediawiki 1 Semantic Drilldown 2023-12-10 N/A 6.1 MEDIUM
A vulnerability classified as problematic has been found in SemanticDrilldown Extension. Affected is the function printFilterLine of the file includes/specials/SDBrowseDataPage.php of the component GET Parameter Handler. The manipulation of the argument value leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 6e18cf740a4548166c1d95f6d3a28541d298a3aa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215964.
CVE-2022-41767 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 5.3 MEDIUM
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigned to a user (using reassignEdits.php), the changes will still be attributed to the IP address on Special:Contributions when doing a range lookup.
CVE-2022-47927 2 Fedoraproject, Mediawiki 2 Fedora, Mediawiki 2023-12-10 N/A 5.5 MEDIUM
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data.
CVE-2021-44855 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 5.4 MEDIUM
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature.
CVE-2023-22911 2 Fedoraproject, Mediawiki 2 Fedora, Mediawiki 2023-12-10 N/A 6.1 MEDIUM
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.
CVE-2023-22909 2 Fedoraproject, Mediawiki 2 Fedora, Mediawiki 2023-12-10 N/A 5.3 MEDIUM
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. SpecialMobileHistory allows remote attackers to cause a denial of service because database queries are slow.
CVE-2023-22945 2 Fedoraproject, Mediawiki 2 Fedora, Mediawiki 2023-12-10 N/A 4.3 MEDIUM
In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit any of their mentorship-related properties.
CVE-2023-22910 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 5.4 MEDIUM
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via wikibase-time-precision-* fields. This allows JavaScript execution by staff/admin users who do not intentionally have the editsitejs capability.
CVE-2023-22912 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 5.3 MEDIUM
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decrypt.
CVE-2021-44854 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 5.3 MEDIUM
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis.
CVE-2021-44856 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 5.3 MEDIUM
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:ChangeContentModel due to the mishandling of the EditFilterMergedContent hook return value.
CVE-2022-41765 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 5.3 MEDIUM
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidden users.
CVE-2022-39193 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 5.3 MEDIUM
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer of edits and logged actions. This information should not allow public viewing: it is supposed to be viewable only by users with suppression rights.
CVE-2021-42046 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 6.1 MEDIUM
An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and allowed for users to inject HTML and JavaScript.
CVE-2021-42049 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 6.5 MEDIUM
An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information (such as PII). This allows oversighters to whitewash revisions.
CVE-2021-42048 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 4.8 MEDIUM
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits.
CVE-2022-34911 2 Fedoraproject, Mediawiki 2 Fedora, Mediawiki 2023-12-10 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text().
CVE-2021-42045 1 Mediawiki 1 Mediawiki 2023-12-10 N/A 5.4 MEDIUM
An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote.
CVE-2022-28201 2 Debian, Mediawiki 2 Debian Linux, Mediawiki 2023-12-10 N/A 4.4 MEDIUM
An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.