VulnerableCode Package Details - pkg:deb/debian/mediawiki-extensions@2.3squeeze2

Search for packages

Vulnerability	Summary	Fixed by
VCID-1n4n-xa7r-aaac Aliases: CVE-2013-6452	Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-3pmj-2b4e-aaab Aliases: CVE-2013-6454	Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-3ze7-fd5k-aaaa Aliases: CVE-2013-4572	The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-6w62-q6j7-aaad Aliases: CVE-2013-2032	MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-6zd8-mffk-aaae Aliases: CVE-2013-6453	MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-8u4s-382t-aaas Aliases: CVE-2013-4568	Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-cdyw-vbrn-aaaq Aliases: CVE-2014-2665	includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-d9js-484j-aaan Aliases: CVE-2013-4567	Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-jxst-e7ku-aaaf Aliases: CVE-2014-1610	MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-mq7r-ry5h-aaaj Aliases: CVE-2013-6472	MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced RecentChanges, and (3) user watchlists.	3.5~deb7u2 Affected by 0 other vulnerabilities.
VCID-w362-nw4d-aaad Aliases: CVE-2013-2031	MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.	3.5~deb7u2 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-1n4n-xa7r-aaac
Aliases:
CVE-2013-6452

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.