PT-2014-4578

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.12 MediaWiki versions 1.20.x MediaWiki versions 1.21.x prior to 1.21.6 MediaWiki versions 1.22.x prior to 1.22.3 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks via an...

CVE-2014-2242: Improper Neutralization of Input During Web Page Generation

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting XSS attacks via an SVG upload, as demonstrated by use of a W...