Vulnerabilities > Mediawiki > Mediawiki > 1.20.5
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-04-13 | CVE-2015-2935 | Information Exposure vulnerability in Mediawiki MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT." | 5.0 |
| 2015-04-13 | CVE-2015-2934 | Cross-site Scripting vulnerability in Mediawiki MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file. | 4.3 |
| 2015-04-13 | CVE-2015-2933 | Cross-site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant. | 4.3 |
| 2015-04-13 | CVE-2015-2932 | Cross-site Scripting vulnerability in Mediawiki Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element. | 4.3 |
| 2015-04-13 | CVE-2015-2931 | Cross-site Scripting vulnerability in Mediawiki Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI. | 4.3 |
| 2015-01-16 | CVE-2014-9480 | Cross-site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text extracts. | 4.3 |
| 2015-01-16 | CVE-2014-9479 | Cross-site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox. | 4.3 |
| 2015-01-16 | CVE-2014-9478 | Cross-site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page. | 2.6 |
| 2015-01-16 | CVE-2014-9477 | Cross-site Scripting vulnerability in Mediawiki Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) url parameter. | 4.3 |
| 2015-01-16 | CVE-2014-9476 | Permissions, Privileges, and Access Controls vulnerability in Mediawiki MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/." | 5.0 |