UBUNTU-CVE-2026-102977
[Unknown description]
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости mediawiki
За последние 30 дней в mediawiki опубликовано уязвимостей: 16; в каталоге KEV: 0.
Уязвимостей: 163
UBUNTU-CVE-2026-102975
[Unknown description]
Опубликовано ОбновленоUBUNTU-CVE-2026-102974
[Unknown description]
Опубликовано ОбновленоUBUNTU-CVE-2026-102973
[Unknown description]
Опубликовано ОбновленоUBUNTU-CVE-2026-102972
[Unknown description]
Опубликовано ОбновленоUBUNTU-CVE-2026-102971
[Unknown description]
Опубликовано ОбновленоUBUNTU-CVE-2026-102970
[Unknown description]
Опубликовано ОбновленоUBUNTU-CVE-2026-102969
[Unknown description]
Опубликовано ОбновленоUBUNTU-CVE-2026-102968
[Unknown description]
Опубликовано ОбновленоUBUNTU-CVE-2026-102967
[Unknown description]
Опубликовано ОбновленоUBUNTU-CVE-2026-102966
[Unknown description]
Опубликовано ОбновленоStored i18n XSSs in CentralNotice
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10.
Опубликовано ОбновленоStored i18n XSS in MassMessage
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.
Опубликовано ОбновленоOpen Redirect in Special:Book
URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.
Опубликовано ОбновленоXSS in Refreshed skin
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.
Опубликовано ОбновленоEasyTimeline should not serve image maps as application/xml
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
Опубликовано Обновленоmediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function
Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fix
Опубликовано ОбновленоRemote Code Execution via Unsafe Deserialization in LogItem Import
Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Опубликовано ОбновленоFull Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Опубликовано ОбновленоPretty-printed API output combined with centralauthtoken allows XSS with certain gadgets
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.