MediaWiki 1.23.6
Approved changes feed: RSS · Atom
cpe:2.3:a:mediawiki:mediawiki:1.23.6:*:*:*:*:*:*:*
part: a version: 1.23.6 update: *
| Vendor | Mediawiki (cdb1ca1d-4622-5407-a7d8-3e891579b8c5) |
|---|---|
| Product | Mediawiki (ab97168e-95e7-5d6e-a2ac-f8d27117dc4d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wikimedia/mediawiki |
purl2cpe | 2026-06-01 10:10:57.618417 |
pkg:wikimedia/mediawiki |
purl2cpe | 2026-06-01 10:10:57.618419 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2015-2942 |
vulnerable | 2026-06-03 14:34:48.310727 |
Details available
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.575Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2941 |
vulnerable | 2026-06-03 14:34:48.309282 |
Details available
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.872Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2938 |
vulnerable | 2026-06-03 14:34:48.280627 |
Details available
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.836Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2937 |
vulnerable | 2026-06-03 14:34:48.279166 |
Details available
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.563Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2935 |
vulnerable | 2026-06-03 14:34:48.277324 |
Details available
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.590Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2934 |
vulnerable | 2026-06-03 14:34:48.275934 |
Details available
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.614Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2933 |
vulnerable | 2026-06-03 14:34:48.274498 |
Details available
Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:21.039Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2932 |
vulnerable | 2026-06-03 14:34:48.272986 |
Details available
Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.386Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2931 |
vulnerable | 2026-06-03 14:34:48.269567 |
Details available
Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.646Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9507 |
vulnerable | 2026-06-03 14:34:27.216987 |
Details available
MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks by setting the content model for a revision to JS.
Published: 2015-01-04T21:00:00.000Z
Updated: 2024-08-06T13:47:40.981Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9487 |
vulnerable | 2026-06-03 14:34:27.153437 |
Details available
The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2053.
Published: 2017-10-17T14:00:00.000Z
Updated: 2024-08-06T13:47:41.107Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9480 |
vulnerable | 2026-06-03 14:34:27.111156 |
Details available
Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text extracts.
Published: 2015-01-16T16:00:00.000Z
Updated: 2024-08-06T13:47:41.057Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9479 |
vulnerable | 2026-06-03 14:34:27.109879 |
Details available
Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox.
Published: 2015-01-16T16:00:00.000Z
Updated: 2024-08-06T13:47:41.125Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9478 |
vulnerable | 2026-06-03 14:34:27.108513 |
Details available
Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page.
Published: 2015-01-16T16:00:00.000Z
Updated: 2024-08-06T13:47:40.998Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9477 |
vulnerable | 2026-06-03 14:34:27.107224 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) url parameter.
Published: 2015-01-16T16:00:00.000Z
Updated: 2024-08-06T13:47:40.370Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9476 |
vulnerable | 2026-06-03 14:34:27.105837 |
Details available
MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/."
Published: 2015-01-16T16:00:00.000Z
Updated: 2024-08-06T13:47:41.126Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9475 |
vulnerable | 2026-06-03 14:34:27.102424 |
Details available
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
Published: 2015-01-16T16:00:00.000Z
Updated: 2024-08-06T13:47:41.530Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9277 |
vulnerable | 2026-06-03 14:34:26.489665 |
Details available
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
Published: 2015-01-04T21:00:00.000Z
Updated: 2024-08-06T13:40:24.904Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9276 |
vulnerable | 2026-06-03 14:34:26.487987 |
Details available
Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgRawHTML is set to true, allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly handled in the preview.
Published: 2015-01-04T21:00:00.000Z
Updated: 2024-08-06T13:40:24.980Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.