CVE-2017-0372 Parameters injection in SyntaxHighlight results in multiple vulnerabilities

Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities...

CVE-2017-0372

CVE-2017-0372 concerns MediaWiki’s SyntaxHighlight extension. The initial description notes parameter injection in the SyntaxHighlight extension could lead to multiple vulnerabilities in affected releases prior to 1.23.16, 1.27.3, and 1.28.2. Connected documents corroborate concrete details: a re...

CVE-2017-0372: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities...

MediaWiki SyntaxHighlight Extended HTML Injection Vulnerability

MediaWiki is a free, web-based wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers for the deployment of in-house knowledge management and content management systems. An HTML injection vulnerability exists in the MediaWiki SyntaxHighlight extension, which ste...

MediaWiki SyntaxHighlight Option Injection (CVE-2017-0372)

A remote code execution vulnerability has been reported in MediaWiki. The vulnerability is due to improper validation of user data. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the target, potentially leading to arbitrary code execution...

MediaWiki SyntaxHighlight Extension Option Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MediaWiki SyntaxHighlight extension option injection vulnerability', 'Description' = %q This module exploits an option injection vulnerability in...

Fedora 25 : mediawiki (2017-3fb95ed01f)

T109140 T122209 Special:UserLogin and Special:Search allow redirect to interwiki links. CVE-2017-0363, CVE-2017-0364 - T144845 XSS in SearchHighlighter::highlightText when $wgAdvancedSearchHighlighting is true. CVE-2017-0365 - T125177 API parameters may now be marked as 'sensitive' to keep their...

MediaWiki SyntaxHighlight extension option injection vulnerability

This module exploits an option injection vulnerability in the SyntaxHighlight extension of MediaWiki. It tries to create & execute a PHP file in the document root. The USERNAME & PASSWORD options are only needed if the Wiki is configured as private. This vulnerability affects any MediaWiki...

PT-2015-7324

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.23.10 MediaWiki versions 1.24.x prior to 1.24.3 MediaWiki versions 1.25.x prior to 1.25.2 SyntaxHighlight GeSHi extension affected versions not specified Description A cross-site scripting XSS issue allows remote...

CVE-2013-4305

Cross-site scripting XSS vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded before September 2013, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2013-4305

CVE-2013-4305 is a Cross-Site Scripting (XSS) vulnerability in the SyntaxHighlight GeSHi extension for MediaWiki, exposed via contrib/example.php. The root cause is improper sanitization of input to the example.php script, allowing an attacker to inject arbitrary script or HTML via PATH_INFO. Pub...

CVE-2013-4305: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded before September 2013, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

MediaWiki < 1.19.8 / 1.20.7 / 1.21.2 Multiple Vulnerabilities

According to its version number, the instance of MediaWiki running on the remote host is affected by the following vulnerabilities : - The full installation path is disclosed in an error message when an invalid language is specified in the ResourceLoader. CVE-2013-4301 - Multiple cross-site reque...

Fedora 16 : python-mwlib-0.13.5-1.fc16 (2012-2994)

Update to version 0.13.5, which solves the following issues : It was reported that mwlib suffered from a flaw that could allow a remote attacker to perform a denial of service attack on a mwlib installation by forcing it to parse a specially crafted iferror magic function. This issue has been...