| CVE-2018-0504 | MÉDIO6.5 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid | 04/10/2018 |
| CVE-2018-0503 | MÉDIO4.3 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'. | 04/10/2018 |
| CVE-2014-1686 | MÉDIO5.3 | MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation. | 16/04/2018 |
| CVE-2017-0372 | CRÍTICO9.8 | Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities. | 13/04/2018 |
| CVE-2017-0370 | MÉDIO5.3 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter. | 13/04/2018 |
| CVE-2017-0369 | MÉDIO6.5 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it. | 13/04/2018 |
| CVE-2017-0368 | MÉDIO5.3 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages. | 13/04/2018 |
| CVE-2017-0367 | ALTO8.8 | Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure. | 13/04/2018 |
| CVE-2017-0366 | MÉDIO5.4 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration. | 13/04/2018 |
| CVE-2017-0365 | MÉDIO4.7 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations. | 13/04/2018 |
| CVE-2017-0364 | MÉDIO6.1 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link. | 13/04/2018 |
| CVE-2017-0363 | MÉDIO6.1 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites. | 13/04/2018 |
| CVE-2017-0362 | ALTO8.8 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token. | 13/04/2018 |
| CVE-2017-0361 | ALTO7.8 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext. | 13/04/2018 |
| CVE-2015-8008 | ALTO7.5 | The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token. | 29/12/2017 |
| CVE-2017-8815 | ALTO7.5 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules. | 15/11/2017 |
| CVE-2017-8814 | ALTO7.5 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk." | 15/11/2017 |
| CVE-2017-8812 | MÉDIO5.3 | MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline. | 15/11/2017 |
| CVE-2017-8811 | MÉDIO6.1 | The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks. | 15/11/2017 |
| CVE-2017-8810 | ALTO7.5 | MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of reque | 15/11/2017 |