Vulnerabilities > Mediawiki > Mediawiki > 1.4.beta1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-01-08 | CVE-2011-4361 | Permissions, Privileges, and Access Controls vulnerability in Mediawiki and Mediawiki Botquery EXT MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions. | 5.0 |
| 2012-01-08 | CVE-2011-4360 | Permissions, Privileges, and Access Controls vulnerability in Mediawiki and Mediawiki Botquery EXT MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter. | 5.0 |
| 2007-02-12 | CVE-2007-0894 | Information Disclosure vulnerability in Mediawiki MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to (1) Simple.deps.php, (2) MonoBook.deps.php, (3) MySkin.deps.php, or (4) Chick.deps.php in wiki/skins, which shows the installation path in the resulting error message. | 5.0 |
| 2006-01-19 | CVE-2006-0322 | Unspecified vulnerability in Mediawiki Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite loop) via "certain malformed links." | 5.0 |
| 2005-12-22 | CVE-2005-4501 | Unspecified vulnerability in Mediawiki MediaWiki before 1.5.4 uses a hard-coded "internal placeholder string", which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes, which are processed by Internet Explorer. network mediawiki | 4.3 |
| 2005-10-06 | CVE-2005-3167 | Cross-Site Scripting vulnerability in MediaWiki HTML Inline Style Attributes Incomplete blacklist vulnerability in MediaWiki before 1.4.11 does not properly remove certain CSS inputs (HTML inline style attributes) that are processed as active content by Internet Explorer, which allows remote attackers to conduct cross-site scripting (XSS) attacks. network mediawiki | 4.3 |
| 2005-10-06 | CVE-2005-3166 | Denial-Of-Service vulnerability in Mediawiki Unspecified vulnerability in "edit submission handling" for MediaWiki 1.4.x before 1.4.10 and 1.3.x before 1.3.16 allows remote attackers to cause a denial of service (corruption of the previous submission) via a crafted URL. | 5.0 |
| 2005-10-06 | CVE-2005-3165 | Unspecified vulnerability in Mediawiki Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.4.9 allow remote attackers to inject arbitrary web script or HTML via (1) <math> tags or (2) Extension or <nowiki> sections that "bypass HTML style attribute restrictions" that are intended to protect against XSS vulnerabilities in Internet Explorer clients. network mediawiki | 4.3 |
| 2005-07-27 | CVE-2005-2396 | Remote Cross-Site Scripting vulnerability in MediaWiki Cross-site scripting (XSS) vulnerability in MediaWiki 1.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the page move template. network mediawiki | 4.3 |
| 2005-06-06 | CVE-2005-1888 | HTML Injection vulnerability in MediaWiki Page Template Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates. network mediawiki | 4.3 |