GCVE - cpe:2.3:a:mediawiki:mediawiki:1.23.8:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mediawiki:mediawiki:1.23.8:*:*:*:*:*:*:*

part: a version: 1.23.8 update: *

Vendor	Mediawiki (`cdb1ca1d-4622-5407-a7d8-3e891579b8c5`)
Product	Mediawiki (`ab97168e-95e7-5d6e-a2ac-f8d27117dc4d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/wikimedia/mediawiki`	purl2cpe	2026-06-01 10:10:57.618423
`pkg:wikimedia/mediawiki`	purl2cpe	2026-06-01 10:10:57.618424

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-2942`	vulnerable	2026-06-03 14:34:48.310759	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.575Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1 https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2941`	vulnerable	2026-06-03 14:34:48.309313	Details available Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.872Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 https://phabricator.wikimedia.org/T85851 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2938`	vulnerable	2026-06-03 14:34:48.280660	Details available Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.836Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2937`	vulnerable	2026-06-03 14:34:48.279200	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.563Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2935`	vulnerable	2026-06-03 14:34:48.277357	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT." Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.590Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2934`	vulnerable	2026-06-03 14:34:48.275967	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.614Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2933`	vulnerable	2026-06-03 14:34:48.274529	Details available Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:21.039Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2932`	vulnerable	2026-06-03 14:34:48.273020	Details available Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.386Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2931`	vulnerable	2026-06-03 14:34:48.270555	Details available Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.646Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 https://phabricator.wikimedia.org/T85850 http://www.openwall.com/lists/oss-security/2015/04/07/3	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.