| Max CVSS | 5.0 | Min CVSS | 4.0 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2016-6333 | 4.3 |
Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:My
|
29-04-2017 - 01:59 | 20-04-2017 - 17:59 | |
| CVE-2016-6334 | 4.3 |
Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving repl
|
29-04-2017 - 01:59 | 20-04-2017 - 17:59 | |
| CVE-2016-6331 | 5.0 |
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
|
24-04-2017 - 20:26 | 20-04-2017 - 17:59 | |
| CVE-2016-6337 | 5.0 |
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
|
24-04-2017 - 20:25 | 20-04-2017 - 17:59 | |
| CVE-2016-6336 | 4.0 |
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitr
|
24-04-2017 - 20:25 | 20-04-2017 - 17:59 | |
| CVE-2016-6335 | 5.0 |
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php.
|
24-04-2017 - 20:24 | 20-04-2017 - 17:59 | |
| CVE-2016-6332 | 5.0 |
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.
|
24-04-2017 - 20:23 | 20-04-2017 - 17:59 |