GCVE - cpe:2.3:a:mediawiki:mediawiki:1.22.14:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mediawiki:mediawiki:1.22.14:*:*:*:*:*:*:*

part: a version: 1.22.14 update: *

Vendor	Mediawiki (`cdb1ca1d-4622-5407-a7d8-3e891579b8c5`)
Product	Mediawiki (`ab97168e-95e7-5d6e-a2ac-f8d27117dc4d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/wikimedia/mediawiki`	purl2cpe	2026-06-01 10:10:57.618331
`pkg:wikimedia/mediawiki`	purl2cpe	2026-06-01 10:10:57.618332

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-2942`	vulnerable	2026-06-03 14:34:48.310597	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.575Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1 https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2941`	vulnerable	2026-06-03 14:34:48.309150	Details available Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.872Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 https://phabricator.wikimedia.org/T85851 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2938`	vulnerable	2026-06-03 14:34:48.280496	Details available Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.836Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2937`	vulnerable	2026-06-03 14:34:48.279034	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.563Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2935`	vulnerable	2026-06-03 14:34:48.277197	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT." Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.590Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2934`	vulnerable	2026-06-03 14:34:48.275801	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.614Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2933`	vulnerable	2026-06-03 14:34:48.274369	Details available Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:21.039Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2932`	vulnerable	2026-06-03 14:34:48.272853	Details available Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.386Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2931`	vulnerable	2026-06-03 14:34:48.265520	Details available Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.646Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 https://phabricator.wikimedia.org/T85850 http://www.openwall.com/lists/oss-security/2015/04/07/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9487`	vulnerable	2026-06-03 14:34:27.153326	Details available The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2053. Published: 2017-10-17T14:00:00.000Z Updated: 2024-08-06T13:47:41.107Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2015/01/03/13 https://security.gentoo.org/glsa/201502-04 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html https://bugzilla.redhat.com/show_bug.cgi?id=1175828	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9480`	vulnerable	2026-06-03 14:34:27.111035	Details available Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text extracts. Published: 2015-01-16T16:00:00.000Z Updated: 2024-08-06T13:47:41.057Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2015/01/03/13 http://www.openwall.com/lists/oss-security/2014/12/21/2 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html https://phabricator.wikimedia.org/T69180	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9479`	vulnerable	2026-06-03 14:34:27.109769	Details available Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox. Published: 2015-01-16T16:00:00.000Z Updated: 2024-08-06T13:47:41.125Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2015/01/03/13 http://www.openwall.com/lists/oss-security/2014/12/21/2 https://phabricator.wikimedia.org/T76195 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9478`	vulnerable	2026-06-03 14:34:27.108403	Details available Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page. Published: 2015-01-16T16:00:00.000Z Updated: 2024-08-06T13:47:40.998Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2015/01/03/13 https://phabricator.wikimedia.org/T73111 http://www.openwall.com/lists/oss-security/2014/12/21/2 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9477`	vulnerable	2026-06-03 14:34:27.107106	Details available Multiple cross-site scripting (XSS) vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) url parameter. Published: 2015-01-16T16:00:00.000Z Updated: 2024-08-06T13:47:40.370Z Open on db.gcve.eu Reference links https://phabricator.wikimedia.org/T77624 http://www.openwall.com/lists/oss-security/2015/01/03/13 http://www.openwall.com/lists/oss-security/2014/12/21/2 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9476`	vulnerable	2026-06-03 14:34:27.105723	Details available MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/." Published: 2015-01-16T16:00:00.000Z Updated: 2024-08-06T13:47:41.126Z Open on db.gcve.eu Reference links https://phabricator.wikimedia.org/T77028 http://www.openwall.com/lists/oss-security/2015/01/03/13 http://www.openwall.com/lists/oss-security/2014/12/21/2 http://www.mandriva.com/security/advisories?name=MDVSA-2015:006 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9475`	vulnerable	2026-06-03 14:34:27.102254	Details available Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message. Published: 2015-01-16T16:00:00.000Z Updated: 2024-08-06T13:47:41.530Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3110 http://www.openwall.com/lists/oss-security/2015/01/03/13 http://www.openwall.com/lists/oss-security/2014/12/21/2 http://www.mandriva.com/security/advisories?name=MDVSA-2015:006 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.