BotPasswords can bypass CentralAuth's account lock
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock
- Mettez à jour vers 1:1.31.1-1
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de mediawiki · Page n° 9
Vulnérabilités publiées pour mediawiki au cours des 30 derniers jours : 9. Présentes dans le catalogue KEV : 0.
Vulnérabilités : 295
Information disclosure in Special:Redirect/logid
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid
- Mettez à jour vers 1:1.31.1-1
Publication Mise à jour$wgRateLimits entry for 'user' overrides 'newbie'
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.
- Mettez à jour vers 1:1.31.1-1
Publication Mise à jourParameters injection in SyntaxHighlight results in multiple vulnerabilities
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
- Mettez à jour vers 1:1.27.3-1
Publication Mise à jourSpam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameter
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jourSysops can undelete pages, although the page is protected against it
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jourMake rawHTML mode not apply to system messages
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jourHaving LocalisationCache directory default to system tmp directory is insecure
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jourSVG filter evasion using default attribute values in DTD declaration
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jourXSS in SearchHighlighter::highlightText() [requires non-default config]
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jourSpecial:Search allows redirects to any interwiki link
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jourSpecial:UserLogin?returnto=interwiki:foo will redirect to external sites
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jour"Mark all pages visited" on the watchlist does not require a CSRF token
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jourapi.log contains passwords in plaintext
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.
- Mettez à jour vers 1:1.27.2-1
Publication Mise à jourCVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- Mettez à jour vers 1:1.27.4-1
Publication Mise à jourCVE-2017-8814
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
- Mettez à jour vers 1:1.27.4-1
Publication Mise à jourCVE-2017-8812
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline.
- Mettez à jour vers 1:1.27.4-1
Publication Mise à jourCVE-2017-8811
The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks.
- Mettez à jour vers 1:1.27.4-1
Publication Mise à jourCVE-2017-8810
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.
- Mettez à jour vers 1:1.27.4-1
Publication Mise à jourCVE-2017-8809
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.
- Mettez à jour vers 1:1.27.4-1
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.