MediaWiki 1.23.7
Approved changes feed: RSS · Atom
cpe:2.3:a:mediawiki:mediawiki:1.23.7:*:*:*:*:*:*:*
part: a version: 1.23.7 update: *
| Vendor | Mediawiki (cdb1ca1d-4622-5407-a7d8-3e891579b8c5) |
|---|---|
| Product | Mediawiki (ab97168e-95e7-5d6e-a2ac-f8d27117dc4d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wikimedia/mediawiki |
purl2cpe | 2026-06-01 10:10:57.618420 |
pkg:wikimedia/mediawiki |
purl2cpe | 2026-06-01 10:10:57.618422 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2015-2942 |
vulnerable | 2026-06-08 05:06:36.273471 |
Details available
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.575Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2941 |
vulnerable | 2026-06-08 05:06:36.272026 |
Details available
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.872Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2938 |
vulnerable | 2026-06-08 05:06:36.241001 |
Details available
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.836Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2937 |
vulnerable | 2026-06-08 05:06:36.239570 |
Details available
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942.
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.563Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2935 |
vulnerable | 2026-06-08 05:06:36.237729 |
Details available
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T05:32:20.590Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2934 |
vulnerable | 2026-06-08 05:06:36.236325 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2933 |
vulnerable | 2026-06-08 05:06:36.234763 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2932 |
vulnerable | 2026-06-08 05:06:36.233137 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2931 |
vulnerable | 2026-06-08 05:06:36.230176 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9487 |
vulnerable | 2026-06-08 05:06:11.937455 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9480 |
vulnerable | 2026-06-08 05:06:11.895886 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9479 |
vulnerable | 2026-06-08 05:06:11.894554 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9478 |
vulnerable | 2026-06-08 05:06:11.893224 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9477 |
vulnerable | 2026-06-08 05:06:11.891931 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9476 |
vulnerable | 2026-06-08 05:06:11.890558 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9475 |
vulnerable | 2026-06-08 05:06:11.888586 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.