Skip to content
OpenAdvisories

Archive

27 September 2020

Vulnerabilities first published on this day (UTC), newest first.

← August 2020 2020 / September /27 October 2020 →
  1. 1192
  2. 2134
  3. 3364
  4. 4123
  5. 51
  6. 6 
  7. 7 
  8. 852
  9. 9124
  10. 1043
  11. 11223
  12. 12 
  13. 136
  14. 1460
  15. 1553
  16. 1682
  17. 17138
  18. 18105
  19. 1912
  20. 20 
  21. 2158
  22. 2234
  23. 2376
  24. 2499
  25. 25112
  26. 26 
  27. 2711
  28. 2810
  29. 2939
  30. 3054
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • Medium 5.3
    CVE-2020-25813

    MediaWiki Special:UserRights exposes the existence of hidden users

    In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • High 7.5
    CVE-2020-25827

    OATHAuth extension in MediaWiki is not implementing rate limit

    An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus…

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Unscored —
    CVE-2020-25869

    An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of act…

  • Medium 6.1
    CVE-2020-25828

    MediaWiki Cross-site Scripting (XSS) vulnerability

    An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be …

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25814

    MediaWiki Cross-site Scripting (XSS) vulnerability

    In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQu…

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25815

    MediaWiki Cross-site Scripting (XSS) vulnerability

    An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names for an HTML multi-select field. The relevant code should use escaped() instead of text().

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25812

    MediaWiki Cross-site Scripting (XSS) vulnerability

    An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw…

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Unscored —
    CVE-2020-26121

    An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even w…

  • Unscored —
    CVE-2020-26120

    XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex …

  • Unscored —
    CVE-2020-26117

    In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptio…

    tigervnc tigervnc Debian Ubuntu
  • Unscored —
    CVE-2020-26116

    http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…

    python3.4 python3.5 python3.6 python3.8 Debian Ubuntu