A persistent XSS vulnerability was discovered due to the way attributes were expanded in MediaWiki's HTML class, in combination with LanguageConverter substitutions.
A way was discovered to bypass the style filtering for SVG files to load external resource. This could violate the anonymity of users viewing the SVG. This issue exists because of an incomplete fix for CVE-2014-7199.
It was discovered that MediaWiki versions using PBKDF2 for password hashing (the default since 1.24) are vulnerable to DoS attacks using extremely long passwords.
It was discovered that MediaWiki is vulnerable to "Quadratic Blowup" denial of service attacks.
It was discovered that function names were not sanitized in Lua error backtraces, which could lead to XSS.
It was discovered that the CheckUser extension did not prevent CSRF attacks on the form allowing checkusers to look up sensitive information about other users. Since the use of CheckUser is logged, the CSRF could be abused to defame a trusted user or flood the logs with noise.
It was discovered that XSS is possible in the way api errors were reflected under HHVM versions before 3.6.1. MediaWiki now detects and mitigates this issue on older versions of HHVM.
It was discovered that MediaWiki's SVG and XMP parsing running under HHVM was susceptible to "Billion Laughs" DoS attacks.