Debian Security Advisory DSA 3011-1 (mediawiki - security update)

It was discovered that MediaWiki, a website engine for collaborative work, is vulnerable to JSONP injection in Flash CVE-2014-5241 and clickjacking between OutputPage and ParserOutput CVE-2014-5243 . The vulnerabilities are addressed by upgrading MediaWiki to the new upstream version 1.19.18, whi...

Debian Security Advisory DSA 2957-1 (mediawiki - security update)

Omer Iqbal discovered that Mediawiki, a wiki engine, parses invalid usernames on Special:PasswordReset as wikitext when $wgRawHtml is enabled. On such wikis this allows an unauthenticated attacker to insert malicious JavaScript, a cross site scripting attack. OpenVAS Vulnerability Test $Id:...