Skip to content
OpenAdvisories

Archive

27 September 2020

Vulnerabilities first published on this day (UTC), newest first.

← August 2020 2020 / September /27 October 2020 →
  1. 1192
  2. 2134
  3. 3364
  4. 4123
  5. 51
  6. 6 
  7. 7 
  8. 852
  9. 9124
  10. 1043
  11. 11223
  12. 12 
  13. 136
  14. 1460
  15. 1553
  16. 1682
  17. 17138
  18. 18105
  19. 1912
  20. 20 
  21. 2158
  22. 2234
  23. 2376
  24. 2499
  25. 25112
  26. 26 
  27. 2711
  28. 2810
  29. 2939
  30. 3054
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.3
    CVE-2020-25813

    MediaWiki Special:UserRights exposes the existence of hidden users

    In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25828

    MediaWiki Cross-site Scripting (XSS) vulnerability

    An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be …

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25814

    MediaWiki Cross-site Scripting (XSS) vulnerability

    In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQu…

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25815

    MediaWiki Cross-site Scripting (XSS) vulnerability

    An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names for an HTML multi-select field. The relevant code should use escaped() instead of text().

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25812

    MediaWiki Cross-site Scripting (XSS) vulnerability

    An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw…

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist