Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 10 | mediawiki | 1:1.31.10-1~deb10u1 |
Vulnerabilities 8
-
High 7.5
OATHAuth extension in MediaWiki is not implementing rate limit
An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus…
-
Medium 6.1
MediaWiki Cross-site Scripting (XSS) vulnerability
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw…
-
Medium 6.1
MediaWiki Cross-site Scripting (XSS) vulnerability
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQu…
-
Medium 6.1
MediaWiki Cross-site Scripting (XSS) vulnerability
An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be …
-
Medium 5.3
MediaWiki Special:UserRights exposes the existence of hidden users
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.
-
Medium —
img_auth.php may leak private extension images into the public cache
In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could v…
-
Unscored —
Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to com…
-
Unscored —
Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may…