Vulnerabilities > Mediawiki > Mediawiki > 1.23.13

DATE CVE VULNERABILITY TITLE RISK
2020-01-27 CVE-2014-9481 Information Exposure vulnerability in Mediawiki
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
network
mediawiki CWE-200
4.3
2019-12-11 CVE-2019-19709 Open Redirect vulnerability in multiple products
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.
network
low complexity
mediawiki debian CWE-601
6.1
2019-09-26 CVE-2019-16738 Missing Authorization vulnerability in multiple products
In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.
network
low complexity
mediawiki fedoraproject debian CWE-862
5.3
2019-07-10 CVE-2019-12470 Missing Authorization vulnerability in multiple products
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control.
network
low complexity
mediawiki debian CWE-862
4.0
2019-07-10 CVE-2019-12469 Missing Authorization vulnerability in multiple products
MediaWiki through 1.32.1 has Incorrect Access Control.
network
low complexity
mediawiki debian CWE-862
4.0
2019-07-10 CVE-2019-12474 Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak.
network
low complexity
mediawiki debian
5.0
2019-07-10 CVE-2019-12472 Unspecified vulnerability in Mediawiki
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1.
network
low complexity
mediawiki
5.0
2019-07-10 CVE-2019-12466 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
Wikimedia MediaWiki through 1.32.1 allows CSRF.
6.8
2019-07-10 CVE-2019-12467 MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3).
network
low complexity
mediawiki debian
5.0
2018-04-13 CVE-2017-0372 Injection vulnerability in multiple products
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
network
low complexity
mediawiki debian CWE-74
7.5