Mediawiki RefreshSpecial Extension 跨站脚本漏洞

Mediawiki RefreshSpecial Extension is an extension of the Wikimedia Foundation. A cross-site scripting vulnerability exists in Mediawiki RefreshSpecial Extension, which stems from improper input neutralization during page generation. The following versions are affected: version 1.39.X to versions...

PT-2025-4810 · Mediawiki · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - OpenBadges Extension versions 1.39.X through 1.39.10 Mediawiki - OpenBadges Extension versions 1.41.X through 1.41.2 Mediawiki - OpenBadges Extension versions 1.42.X through 1.42.1 Description: The issue is related to Improper...

CVE-2024-47841 Path traversal when loading stylesheets

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9...

PT-2024-32845 · Mediawiki · Mediawiki

Name of the Vulnerable Software and Affected Versions: Mediawiki - Apex skin versions 1.39.X through 1.39.8 Mediawiki - Apex skin versions 1.41.X through 1.41.2 Mediawiki - Apex skin versions 1.42.X through 1.42.1 Description: The issue is related to Improper Neutralization of Input During Web Pa...

PT-2022-27687 · Unknown · Fusionauth

Name of the Vulnerable Software and Affected Versions: FusionAuth versions prior to 1.41.3 Description: The issue allows an attacker to view or retrieve files outside of the application root using an HTTP request. Specifically, an attacker may be able to access any file readable by the user runni...

CVE-2022-45921

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process...

Authorization

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. Note that the server socket...