Skip to content
OpenAdvisories
Unscored DSA-2891-1 11 CVEs

mediawiki - security update

Published Mar 30, 2014 · Updated Mar 9, 2026

Fixed packages 2

ReleasePackageFixed in
Debian · 7 mediawiki 1:1.19.14+dfsg-0+deb7u1
Debian · 7 mediawiki-extensions 3.5~deb7u1

Vulnerabilities 11

  • Unscored —

    MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks,…

  • Unscored —

    MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using bo…

  • Unscored —

    Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x …

  • Unscored —

    Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x …

  • Unscored —

    The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-…

  • Unscored —

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allo…

  • Unscored —

    MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allo…

  • Unscored —

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allo…

  • Unscored —

    MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information ab…

  • Unscored —
    CVE-2014-1610 Public exploit EPSS 43%

    MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support i…

  • Unscored —

    includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x be…