Mediawiki : Security Vulnerabilities Published In 2010
# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2010-1648 |
352 |
|
CSRF |
2010-06-07 |
2010-07-30 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form. |
2 |
CVE-2010-1647 |
79 |
|
XSS |
2010-06-07 |
2010-07-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer. |
3 |
CVE-2010-1190 |
264 |
|
Bypass |
2010-03-31 |
2013-09-13 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as img_auth.php, does not check user permissions before providing scaled images, which allows remote attackers to bypass intended access restrictions and read private images via unspecified manipulations. |
4 |
CVE-2010-1189 |
20 |
|
+Info |
2010-03-31 |
2010-05-20 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
MediaWiki before 1.15.2 does not prevent wiki editors from linking to images from other web sites in wiki pages, which allows editors to obtain IP addresses and other information of wiki users by adding a link to an image on an attacker-controlled web site, aka "CSS validation issue." |
5 |
CVE-2010-1150 |
352 |
|
CSRF |
2010-04-20 |
2010-05-08 |
6.0 |
User |
Remote |
Medium |
Single system |
Partial |
Partial |
Partial |
MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue. |
6 |
CVE-2009-4589 |
79 |
|
XSS |
2010-01-07 |
2017-08-16 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter. |
Total number of vulnerabilities :
6
Page :
1
(This Page)