| Max CVSS | 7.1 | Min CVSS | 4.3 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2015-2940 | 6.8 |
Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors.
|
07-12-2016 - 18:11 | 13-04-2015 - 14:59 | |
| CVE-2015-2937 | 7.1 |
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration wit
|
07-12-2016 - 18:11 | 13-04-2015 - 14:59 | |
| CVE-2015-2941 | 4.3 |
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to a
|
07-12-2016 - 18:11 | 13-04-2015 - 14:59 | |
| CVE-2015-2942 | 7.1 |
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP me
|
07-12-2016 - 18:11 | 13-04-2015 - 14:59 | |
| CVE-2015-2939 | 4.3 |
Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace.
|
07-12-2016 - 18:11 | 13-04-2015 - 14:59 | |
| CVE-2015-2938 | 4.3 |
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when preview
|
07-12-2016 - 18:11 | 13-04-2015 - 14:59 | |
| CVE-2015-2936 | 7.1 |
MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password.
|
07-12-2016 - 18:10 | 13-04-2015 - 14:59 | |
| CVE-2015-2932 | 4.3 |
Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.
|
07-12-2016 - 18:10 | 13-04-2015 - 14:59 | |
| CVE-2015-2934 | 4.3 |
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted
|
07-12-2016 - 18:10 | 13-04-2015 - 14:59 | |
| CVE-2015-2935 | 5.0 |
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."
|
07-12-2016 - 18:10 | 13-04-2015 - 14:59 | |
| CVE-2015-2931 | 4.3 |
Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a neste
|
07-12-2016 - 18:10 | 13-04-2015 - 14:59 | |
| CVE-2015-2933 | 4.3 |
Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using
|
07-12-2016 - 18:10 | 13-04-2015 - 14:59 |