CVE-2016-6332

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked...

CVE-2016-6332: Exposure of Sensitive Information to an Unauthorized Actor

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked...

PT-2017-8962

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.23.15 MediaWiki versions 1.26.x prior to 1.26.4 MediaWiki versions 1.27.x prior to 1.27.1 Description The issue might allow remote attackers to obtain sensitive information by leveraging failure to terminate...

CVE-2011-1766

includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an...

PT-2011-3357

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.16.5 Description The issue allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation, due to the failure to clear certain...

Fedora 13 : mediawiki-1.16.5-59.fc13 (2011-6775)

MediaWiki 1.16.5 was released to correct two security flaws : The first issue is yet another recurrence of the Internet Explorer 6 XSS vulnerability that caused the release of 1.16.4. It was pointed out that there are dangerous extensions with more than four characters, so the regular expressions...

Fedora 14 : mediawiki-1.16.5-59.fc14 (2011-6774)

MediaWiki 1.16.5 was released to correct two security flaws : The first issue is yet another recurrence of the Internet Explorer 6 XSS vulnerability that caused the release of 1.16.4. It was pointed out that there are dangerous extensions with more than four characters, so the regular expressions...

Fedora 15 : mediawiki-1.16.5-59.fc15 (2011-6781)

MediaWiki 1.16.5 was released to correct two security flaws : The first issue is yet another recurrence of the Internet Explorer 6 XSS vulnerability that caused the release of 1.16.4. It was pointed out that there are dangerous extensions with more than four characters, so the regular expressions...

mediawiki -- multiple vulnerabilities

Mediawiki reports: Bug 28534 XSS vulnerability for IE 6 clients. This is the third attempt at fixing bug 28235. Bug 28639 Potential privilege escalation when $wgBlockDisablesLogin is enabled...