CVE-2019-12471

Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

CVE-2019-12471

MediaWiki CVE-2019-12471: A cross-site scripting flaw exists in MediaWiki 1.30.0–1.32.1 when loading user JavaScript from a non-existent account, allowing XSS on users who load that script. Affected: 1.30.0–1.32.1. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. Upgrade to a fixed release to mitigate.

CVE-2019-12473

MediaWiki CVE-2019-12473 affects 1.27.0–1.32.1; passing invalid titles to the API could trigger a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

CVE-2019-12466

Wikimedia MediaWiki through 1.32.1 allows CSRF...

CVE-2019-12466

MediaWiki before 1.32.2 is affected by CVE-2019-12466: a cross‑site request forgery in the logout feature that can occur without a token. The initial description states CSRF in MediaWiki 1.32.1 and prior. Connected advisories confirm fixes in newer releases (e.g., Mageia lists 1.32.2-alt1; Debian...

CVE-2019-12466

Wikimedia MediaWiki through 1.32.1 allows CSRF...

CVE-2019-12468

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover...

CVE-2019-12468

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover...

CVE-2019-12468

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover...

Improper access control

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover...

CVE-2019-12468

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover...

CVE-2019-12468

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover...

CVE-2019-12468

CVE-2019-12468 affects MediaWiki 1.27.0–1.32.1. The issue is an Incorrect Access Control vulnerability where directly POSTing to Special:ChangeEmail bypasses re-authentication, enabling potential account takeover. Connected advisories confirm the flaw and describe remediation in vendor packages: ...

Fedora Update for mediawiki FEDORA-2019-02046db281

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Direct POST to Special:ChangeEmail will bypass reauth check

More info at https://phabricator.wikimedia.org/T197279...

API responses for unpatrolled or (not) autopatrolled recent changes require privileges but may be cached publicly

More info at https://phabricator.wikimedia.org/T212118...

Exposed suppressed username or log in Special:EditTags

More info at https://phabricator.wikimedia.org/T222036...

Loading JS from user space where the username is not a registered account is dangerous and should be banned

More info at https://phabricator.wikimedia.org/T207603...

[SECURITY] Fedora 28 Update: mediawiki-1.29.3-1.fc28

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

[SECURITY] Fedora 27 Update: mediawiki-1.29.3-1.fc27

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...