1.4.0

DATE	CVE	VULNERABILITY TITLE	RISK
2007-02-21	CVE-2007-1054	Cross-Site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.6.x through 1.9.2, when $wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded value of the rs parameter, which is processed by Internet Explorer. network mediawiki	6.8
2006-05-26	CVE-2006-2611	Cross-Site Scripting vulnerability in Mediawiki Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in the variable handler in MediaWiki 1.6.x before r14349 allows remote attackers to inject arbitrary Javascript via unspecified vectors, possibly involving the usage of the \| (pipe) character. network mediawiki	4.3
2005-12-22	CVE-2005-4501	Unspecified vulnerability in Mediawiki MediaWiki before 1.5.4 uses a hard-coded "internal placeholder string", which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes, which are processed by Internet Explorer. network mediawiki	4.3