Information disclosure in Special:Redirect/logid
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid
- Обновитесь до 1:1.31.1-1
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости mediawiki · Страница 9
За последние 30 дней в mediawiki опубликовано уязвимостей: 9; в каталоге KEV: 0.
Уязвимостей: 294
$wgRateLimits entry for 'user' overrides 'newbie'
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.
- Обновитесь до 1:1.31.1-1
Опубликовано ОбновленоParameters injection in SyntaxHighlight results in multiple vulnerabilities
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
- Обновитесь до 1:1.27.3-1
Опубликовано ОбновленоSpam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameter
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.
- Обновитесь до 1:1.27.2-1
Опубликовано ОбновленоSysops can undelete pages, although the page is protected against it
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.
- Обновитесь до 1:1.27.2-1
Опубликовано ОбновленоMake rawHTML mode not apply to system messages
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.
- Обновитесь до 1:1.27.2-1
Опубликовано ОбновленоHaving LocalisationCache directory default to system tmp directory is insecure
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.
- Обновитесь до 1:1.27.2-1
Опубликовано ОбновленоSVG filter evasion using default attribute values in DTD declaration
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.
- Обновитесь до 1:1.27.2-1
Опубликовано ОбновленоXSS in SearchHighlighter::highlightText() [requires non-default config]
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.
- Обновитесь до 1:1.27.2-1
Опубликовано ОбновленоSpecial:Search allows redirects to any interwiki link
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.
- Обновитесь до 1:1.27.2-1
Опубликовано ОбновленоSpecial:UserLogin?returnto=interwiki:foo will redirect to external sites
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.
- Обновитесь до 1:1.27.2-1
Опубликовано Обновлено"Mark all pages visited" on the watchlist does not require a CSRF token
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.
- Обновитесь до 1:1.27.2-1
Опубликовано Обновленоapi.log contains passwords in plaintext
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.
- Обновитесь до 1:1.27.2-1
Опубликовано ОбновленоCVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- Обновитесь до 1:1.27.4-1
Опубликовано ОбновленоCVE-2017-8814
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
- Обновитесь до 1:1.27.4-1
Опубликовано ОбновленоCVE-2017-8812
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline.
- Обновитесь до 1:1.27.4-1
Опубликовано ОбновленоCVE-2017-8811
The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks.
- Обновитесь до 1:1.27.4-1
Опубликовано ОбновленоCVE-2017-8810
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.
- Обновитесь до 1:1.27.4-1
Опубликовано ОбновленоCVE-2017-8809
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.
- Обновитесь до 1:1.27.4-1
Опубликовано ОбновленоCVE-2017-8808
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-standard URL escaping.
- Обновитесь до 1:1.27.4-1
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.