Search for packages
| purl | pkg:composer/mediawiki/core@1.21.11 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4216-ztjb-hke8
Aliases: CVE-2020-15005 GHSA-xpv7-93cm-4mxv |
img_auth.php may leak private extension images into the public cache In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled. |
Affected by 8 other vulnerabilities. Affected by 9 other vulnerabilities. Affected by 9 other vulnerabilities. |
|
VCID-6nc9-g17a-ykds
Aliases: CVE-2021-41800 GHSA-c8wv-qwwc-6j73 |
multiple issues |
Affected by 1 other vulnerability. |
|
VCID-brw1-z6vq-hbdc
Aliases: CVE-2019-12472 GHSA-7mqg-5fgh-xh4r |
MediaWiki Incorrect Access Control vulnerability An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 11 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-ezum-tdjw-mbap
Aliases: CVE-2023-29141 GHSA-5vj8-g3qg-4qh6 |
X-Forwarded-For header allows brute-forcing autoblocked IP addresses An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-jpww-qv6m-m3eg
Aliases: CVE-2019-12467 GHSA-6vfg-8ppv-h5hg |
MediaWiki Incorrect Access Control vulnerability MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 11 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-ph5q-kshb-bqb7
Aliases: CVE-2020-10959 GHSA-mqhw-wq8p-vf5r |
MediaWiki Open Redirect vulnerability resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.34.0-rc.0 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page. |
Affected by 9 other vulnerabilities. |
|
VCID-rxjs-5p57-wbh1
Aliases: CVE-2023-45363 GHSA-w5fx-cx7f-6vr9 |
MediaWiki Denial of Service vulnerability An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||