Design/Logic Flaw

ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

CVE-2019-19328

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

PT-2019-15811

Name of the Vulnerable Software and Affected Versions Wikibase Wikidata Query Service GUI versions prior to 0.3.6-SNAPSHOT 2019-11-07 Description The issue allows for arbitrary JavaScript execution, which can occur when mathematical expressions in results are displayed directly. This can lead to...

CVE-2019-19329: Improper Neutralization of Input During Web Page Generation

In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no...

PT-2019-15809

Name of the Vulnerable Software and Affected Versions Wikibase Wikidata Query Service GUI versions prior to 0.3.6-SNAPSHOT Description The issue allows HTML injection when reporting the number of results and number of milliseconds in the ui/ResultView.js file. Recommendations For versions prior t...

PT-2019-15810

Name of the Vulnerable Software and Affected Versions Wikibase Wikidata Query Service GUI versions prior to 0.3.6-SNAPSHOT Description The issue allows HTML injection in tooltips for entities, specifically affecting the ui/editor/tooltip/Rdf.js component. This could potentially lead to malicious...