CVE-2024-38652: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary file deletion...

Cross-Site Scripting (XSS)

mediawiki/metrolook-skin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in MediaWiki top-level menu entries, allowing attackers to inject and execute arbitrary script code...

BIT-MEDIAWIKI-2024-40600

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

BIT-MEDIAWIKI-2024-40602

An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

BIT-MEDIAWIKI-2024-40604

An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries...

BIT-MEDIAWIKI-2024-40605

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40605

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40604

An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries...

CVE-2024-40600

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40602: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40599: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40600: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40605: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

PT-2024-28936 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki Metrolook skin versions through 1.42.1 Description: An issue was discovered in the Metrolook skin for MediaWiki, where there is stored XSS via MediaWiki:Sidebar top-level menu entries. Recommendations: For versions through 1.42.1,...

CVE-2024-40599

An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40605

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40604

An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries...

CVE-2024-40600

Affected software: Metrolook skin for MediaWiki up to version 1.42.1. Vulnerability: stored XSS via MediaWiki:Sidebar top-level menu entries. Impact: can lead to execution of arbitrary script in a victim’s browser; exploitation details are not provided in the documents. Root cause: improper handl...

CVE-2024-40600

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40604

CVE-2024-40604 affects the Nimbus skin for MediaWiki up to version 1.42.1. The issue is a Stored XSS vulnerability exposed via MediaWiki:Nimbus-sidebar menu and submenu entries. The connected sources confirm the vulnerability details but do not provide exploitation specifics or a published patch/...