MediaWiki 1.16.0 Beta 3
Approved changes feed: RSS · Atom
cpe:2.3:a:mediawiki:mediawiki:1.16.0:beta3:*:*:*:*:*:*
part: a version: 1.16.0 update: beta3
| Vendor | Mediawiki (cdb1ca1d-4622-5407-a7d8-3e891579b8c5) |
|---|---|
| Product | Mediawiki (ab97168e-95e7-5d6e-a2ac-f8d27117dc4d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wikimedia/mediawiki |
purl2cpe | 2026-06-01 10:10:57.599604 |
pkg:wikimedia/mediawiki |
purl2cpe | 2026-06-01 10:10:57.599605 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2014-2853 |
vulnerable | 2026-06-03 14:33:51.991384 |
Details available
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
Published: 2014-04-29T18:00:00.000Z
Updated: 2024-08-06T10:28:46.374Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-2244 |
vulnerable | 2026-06-03 14:33:50.161394 |
Details available
Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.
Published: 2014-03-02T02:00:00.000Z
Updated: 2024-08-06T10:06:00.222Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-2243 |
vulnerable | 2026-06-03 14:33:50.159023 |
Details available
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.
Published: 2014-03-02T02:00:00.000Z
Updated: 2024-08-06T10:06:00.267Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-2242 |
vulnerable | 2026-06-03 14:33:50.139020 |
Details available
includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
Published: 2014-03-02T02:00:00.000Z
Updated: 2024-08-06T10:06:00.324Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-2032 |
vulnerable | 2026-06-03 14:32:53.315640 |
Details available
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
Published: 2013-11-15T18:16:00.000Z
Updated: 2024-08-06T15:20:37.400Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-2031 |
vulnerable | 2026-06-03 14:32:53.299782 |
Details available
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.
Published: 2013-11-15T18:16:00.000Z
Updated: 2024-08-06T15:20:37.509Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-2698 |
vulnerable | 2026-06-03 14:31:54.430711 |
Details available
Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page.
Published: 2012-06-29T19:00:00.000Z
Updated: 2024-08-06T19:42:31.984Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.