BotPasswords can bypass CentralAuth's account lock
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock
- Actualiza a 1:1.31.1-1
Publicación Actualización
PatchFirst · Vulnerabilidades recientes
Vulnerabilidades de mediawiki · Página 9
Vulnerabilidades publicadas para mediawiki en los últimos 30 días: 9. Incluidas en el catálogo KEV: 0.
Vulnerabilidades: 295
Information disclosure in Special:Redirect/logid
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid
- Actualiza a 1:1.31.1-1
Publicación Actualización$wgRateLimits entry for 'user' overrides 'newbie'
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.
- Actualiza a 1:1.31.1-1
Publicación ActualizaciónParameters injection in SyntaxHighlight results in multiple vulnerabilities
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
- Actualiza a 1:1.27.3-1
Publicación ActualizaciónSpam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameter
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.
- Actualiza a 1:1.27.2-1
Publicación ActualizaciónSysops can undelete pages, although the page is protected against it
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.
- Actualiza a 1:1.27.2-1
Publicación ActualizaciónMake rawHTML mode not apply to system messages
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.
- Actualiza a 1:1.27.2-1
Publicación ActualizaciónHaving LocalisationCache directory default to system tmp directory is insecure
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.
- Actualiza a 1:1.27.2-1
Publicación ActualizaciónSVG filter evasion using default attribute values in DTD declaration
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.
- Actualiza a 1:1.27.2-1
Publicación ActualizaciónXSS in SearchHighlighter::highlightText() [requires non-default config]
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.
- Actualiza a 1:1.27.2-1
Publicación ActualizaciónSpecial:Search allows redirects to any interwiki link
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.
- Actualiza a 1:1.27.2-1
Publicación ActualizaciónSpecial:UserLogin?returnto=interwiki:foo will redirect to external sites
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.
- Actualiza a 1:1.27.2-1
Publicación Actualización"Mark all pages visited" on the watchlist does not require a CSRF token
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.
- Actualiza a 1:1.27.2-1
Publicación Actualizaciónapi.log contains passwords in plaintext
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.
- Actualiza a 1:1.27.2-1
Publicación ActualizaciónCVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- Actualiza a 1:1.27.4-1
Publicación ActualizaciónCVE-2017-8814
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
- Actualiza a 1:1.27.4-1
Publicación ActualizaciónCVE-2017-8812
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline.
- Actualiza a 1:1.27.4-1
Publicación ActualizaciónCVE-2017-8811
The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks.
- Actualiza a 1:1.27.4-1
Publicación ActualizaciónCVE-2017-8810
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.
- Actualiza a 1:1.27.4-1
Publicación ActualizaciónCVE-2017-8809
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.
- Actualiza a 1:1.27.4-1
Publicación Actualización
Comprueba tu servidor
Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.