Xxe

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites...

CVE-2017-0363 Special:UserLogin?returnto=interwiki:foo will redirect to external sites

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites...

CVE-2017-0363

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites...

CVE-2017-0363: URL Redirection to Untrusted Site

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites...

PT-2018-5122

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.28.1 MediaWiki versions prior to 1.27.2 MediaWiki versions prior to 1.23.16 Description The issue allows for redirection to external sites through the Special:UserLogin page, specifically when the returnto paramet...

Cross site scripting

The 1 Special:Preferences and 2 Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting XSS attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying...

CVE-2014-7295

The 1 Special:Preferences and 2 Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting XSS attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying...

CVE-2014-7295

The CVE-2014-7295 entry affects MediaWiki; remote authenticated users could trigger cross-site scripting via crafted CSS on Special:Preferences and Special:UserLogin in affected branches (before 1.19.20, 1.22.x before 1.22.12, and 1.23.x before 1.23.5). The issue arises from CSS-based injection (...

PT-2014-7887

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.20 MediaWiki versions 1.22.x prior to 1.22.12 MediaWiki versions 1.23.x prior to 1.23.5 Description The issue affects the Special:Preferences and Special:UserLogin pages in MediaWiki, allowing remote...

CVE-2014-7295: Improper Neutralization of Input During Web Page Generation

The 1 Special:Preferences and 2 Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting XSS attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying...

CVE-2012-5391

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

CVE-2012-5391

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

PT-2014-2307

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.18.6 MediaWiki versions 1.19.x prior to 1.19.3 MediaWiki versions 1.20.x prior to 1.20.1 Description The issue allows remote attackers to hijack web sessions via the session id. This is related to a session fixati...

CVE-2012-5391: Undefined Security Weakness

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

Fedora 13 : mediawiki-1.15.4-54.fc13 (2010-10779)

This update fixes two vulnerabilities in mediawiki CVE-2010-1647 Cross-site scripting XSS vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets CSS strings that are processed as...

MediaWiki 1.15.x < 1.15.4, 1.16.x < 1.16 beta 3 XSS and CSRF Vulnerabilities

MediaWiki is prone to cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2010-1648

Cross-site request forgery CSRF vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that 1 create accounts or 2 reset passwords, related to the Special:Userlogin form...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that 1 create accounts or 2 reset passwords, related to the Special:Userlogin form...

CVE-2010-1648

Cross-site request forgery CSRF vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that 1 create accounts or 2 reset passwords, related to the Special:Userlogin form...

CVE-2010-1648

MediaWiki 1.15.x before 1.15.4 and 1.16 before 1.16 beta 3 contains a CSRF in the login interface (Special:Userlogin) that can allow remote attackers to hijack user authentication for account creation or password reset. Affected products/versions are MediaWiki 1.15.x prior to 1.15.4 and 1.16 prio...