MediaWiki Security Breach

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki, which stems from includes/page/Article.php checking...

PT-2023-6328 · Mediawiki +2 · Mediawiki +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.36.x through 1.39.x before 1.39.5 MediaWiki versions 1.40.x before 1.40.1 Description: An issue was discovered in includes/page/Article.php. Deleted revision existence is leaked due to incorrect permissions being checked,...

CVE-2023-25980

CVE-2023-25980 concerns the WordPress plugin “Optimize Database after Deleting Revisions” (CAGE Web Design) with CSRF vulnerability in versions

WordPress Optimize Database after Deleting Revisions Plugin <= 5.0.110 is vulnerable to Broken Access Control

Software Optimize Database after Deleting Revisions Type Plugin Vulnerable versions = 5.0.110 Fixed in 5.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID fb16d5eb812a Credits WordFence...

CVE-2023-25980: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin = 5.1 versions...

CLSA-2023-1692295639 Update of microcode_ctl

Update Intel CPU microcode to microcode-20230512 release: - Addition of 06-9a-04/0x40 microcode at revision 0x4; - Addition of 06-be-00/0x01 microcode at revision 0x10; - Update of 06-55-03/0x97 SKX-SP B1 microcode from revision 0x1000161 up to 0x1000171; - Update of 06-55-04/0xb7 SKX-D/SP/W/X...

CLSA-2023-1692295398 Update of microcode_ctl

Update Intel CPU microcode to microcode-20230512-rev.2 release: - Addition of 06-9a-04/0x40 microcode at revision 0x4; - Addition of 06-be-00/0x01 microcode at revision 0x10; - Update of 06-55-03/0x97 SKX-SP B1 microcode from revision 0x1000161 up to 0x1000171; - Update of 06-55-04/0xb7...

CVE-2023-20569

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure...

Access Control Bypass

drupal/core is vulnerable to Access Control Bypass. The API was not integrated with existing permission controls, resulting in access bypass for users who have access to revisions of content, but not individual items...

UBUNTU-CVE-2022-25274

Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual...

CVE-2022-25274

Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual...

CVE-2022-25274

Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual...

SUSE CVE-2022-28349

Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Valhall r19p0 through r23p0 before r24p0...

SUSE CVE-2022-28350

Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation...

CVE-2021-40342

In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. This issue affects FOXMAN-UN product:...

CVE-2021-42049

An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information such as PII. This allows oversighters to whitewash revisions...

CVE-2021-42049

An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information such as PII. This allows oversighters to whitewash revisions...

CVE-2021-42049

An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information such as PII. This allows oversighters to whitewash revisions...

Code injection

An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information such as PII. This allows oversighters to whitewash revisions...

GHSA-MW37-WX8P-GP45 Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts

Craft CMS 3.70-RC1–3.7.55.1 and 4.0.0-RC1–4.2.0.1 are vulnerable to Cross Site Scripting XSS via entry revisions and drafts. Versions 3.7.55.2 and 4.2.1 contain patches for this issue...