MediaWiki 1.24.4
Approved changes feed: RSS · Atom
cpe:2.3:a:mediawiki:mediawiki:1.24.4:*:*:*:*:*:*:*
part: a version: 1.24.4 update: *
| Vendor | Mediawiki (cdb1ca1d-4622-5407-a7d8-3e891579b8c5) |
|---|---|
| Product | Mediawiki (ab97168e-95e7-5d6e-a2ac-f8d27117dc4d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wikimedia/mediawiki |
purl2cpe | 2026-06-01 10:10:57.618454 |
pkg:wikimedia/mediawiki |
purl2cpe | 2026-06-01 10:10:57.618455 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2015-8628 |
vulnerable | 2026-06-08 05:07:04.546976 |
Details available
The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.
Published: 2017-03-23T20:00:00.000Z
Updated: 2024-08-06T08:20:43.576Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-8627 |
vulnerable | 2026-06-08 05:07:04.546397 |
Details available
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.
Published: 2017-03-23T20:00:00.000Z
Updated: 2024-08-06T08:20:43.575Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-8626 |
vulnerable | 2026-06-08 05:07:04.545685 |
Details available
The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack.
Published: 2017-03-23T20:00:00.000Z
Updated: 2024-08-06T08:20:43.535Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-8625 |
vulnerable | 2026-06-08 05:07:04.545110 |
Details available
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
Published: 2017-03-23T20:00:00.000Z
Updated: 2024-08-06T08:20:43.531Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-8624 |
vulnerable | 2026-06-08 05:07:04.544527 |
Details available
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.
Published: 2017-03-23T20:00:00.000Z
Updated: 2024-08-06T08:20:43.559Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-8623 |
vulnerable | 2026-06-08 05:07:04.543993 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-8622 |
vulnerable | 2026-06-08 05:07:04.541657 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.