Vulnerabilities > Mediawiki > Mediawiki > 1.24.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-04-13 | CVE-2015-2937 | Resource Management Errors vulnerability in Mediawiki MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942. | 7.1 |
| 2015-04-13 | CVE-2015-2936 | Resource Management Errors vulnerability in Mediawiki 1.24.0/1.24.1 MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password. | 7.1 |
| 2015-04-13 | CVE-2015-2935 | Information Exposure vulnerability in Mediawiki MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT." | 5.0 |
| 2015-04-13 | CVE-2015-2934 | Cross-site Scripting vulnerability in Mediawiki MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file. | 4.3 |
| 2015-04-13 | CVE-2015-2933 | Cross-site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant. | 4.3 |
| 2015-04-13 | CVE-2015-2932 | Cross-site Scripting vulnerability in Mediawiki Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element. | 4.3 |
| 2015-04-13 | CVE-2015-2931 | Cross-site Scripting vulnerability in Mediawiki Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI. | 4.3 |
| 2015-01-16 | CVE-2014-9480 | Cross-site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text extracts. | 4.3 |
| 2015-01-16 | CVE-2014-9479 | Cross-site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox. | 4.3 |
| 2015-01-16 | CVE-2014-9478 | Cross-site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page. | 2.6 |