Debian Mediawiki vulnerabilities

CVE-2015-2941 [MEDIUM] CVE-2015-2941: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x befor... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value. Scope: l

CVE-2015-2939 [MEDIUM] CVE-2015-2939: mediawiki - Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWik... Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace. Scope: local bookworm: resolved (fixed in 1:1.19.20+dfsg-2.3) bullseye: resolved (fixed in 1:1.19.20+dfsg-2.3) forky: resolved (fixed in 1:1.19.

CVE-2015-2933 [MEDIUM] CVE-2015-2933: mediawiki - Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1... Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant. Scope: local bookworm: resolved (fixed in 1:1.19.20+dfsg-2.3) bullseye: resolved (fixed in 1:1.

CVE-2014-7199 [MEDIUM] CVE-2014-7199: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x bef... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file. Scope: local bookworm: resolved (fixed in 1:1.19.19+dfsg-1) bullseye: resolved (fixed in 1:1.19.19+dfsg-1) forky: resolved (fixed in 1:1.19.19+dfsg-1) sid: resol

CVE-2018-0503 [MEDIUM] CVE-2018-0503: mediawiki - Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where co... Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'. Scope: local bookworm: resolved (fixed in 1:1.31.1-1) bullseye: resolved (fixed in 1:1.31.1-1) forky: resolved (fixed in 1:1.31.1-1) sid: resolved (fixed in 1:1.31.1-1) trixie: resolved (fixed in 1

CVE-2013-4567 [MEDIUM] CVE-2013-4567: mediawiki - Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.... Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS. Scope: local bookworm: resolved (fixed in 1:1.19.8+dfsg-2.2) bullseye: resolved (fixed in 1:1.19.8+dfsg-2.2) forky: resolved

CVE-2011-1578 [MEDIUM] CVE-2011-1578: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Intern... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot

CVE-2013-2031 [MEDIUM] CVE-2013-2031: mediawiki - MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to cond... MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox. Scope: local bookworm: resolved (fixed in 1:1.19.6-1) bullseye: resolved (fixed in 1:

CVE-2013-4568 [MEDIUM] CVE-2013-4568: mediawiki - Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.... Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are con

CVE-2015-2938 [MEDIUM] CVE-2015-2938: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x befor... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file. Scope: local bookworm: resolved (fixed in 1:1.19.20+dfsg-2.3) bullseye: resolved (fixed in 1:1.19.20+d

CVE-2015-6730 [MEDIUM] CVE-2015-6730: mediawiki - Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.1... Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images." Scope: local bookworm: resolved (fixed in 1:1.25.5-1) bullseye: resolved

CVE-2008-5249 [MEDIUM] CVE-2008-5249: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allo... Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Scope: local bookworm: resolved (fixed in 1:1.13.3-1) bullseye: resolved (fixed in 1:1.13.3-1) forky: resolved (fixed in 1:1.13.3-1) sid: resolved (fixed in 1:1.13.3-1) trixie: resolved (fixed in 1:1.13

CVE-2025-61638 [NONE] CVE-2025-61638: mediawiki - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site ... Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * bef

CVE-2013-6454 [MEDIUM] CVE-2013-6454: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x befor... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute. Scope: local bookworm: resolved (fixed in 1:1.19.10+dfsg-1) bullseye: resolved (fixed in 1:1.19.10+dfsg-1) forky: resolved (fixed in 1:1.19.10+dfsg-1) sid: resolve

CVE-2006-1498 [MEDIUM] CVE-2006-1498: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.5.8 and 1.4.15 al... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.5.8 and 1.4.15 allows remote attackers to inject arbitrary web script or HTML via crafted encoded links. Scope: local bookworm: resolved (fixed in 1.4.15-1) bullseye: resolved (fixed in 1.4.15-1) forky: resolved (fixed in 1.4.15-1) sid: resolved (fixed in 1.4.15-1) trixie: resolved (fixed in 1.4.15-1)

CVE-2011-1587 [MEDIUM] CVE-2011-1587: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Intern... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence

CVE-2025-6597 [NONE] CVE-2025-6597: mediawiki - Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associate... Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0. Scope: local bookworm: resolved (fixed in 1:1.39.13-1~deb12u1) bullseye: resolved (fixed in 1:1.35.13-1+deb11u4) forky: resolved (fixed in 1:1.43.3+dfsg-1) sid

CVE-2025-61635 [NONE] CVE-2025-61635: mediawiki - Vulnerability in Wikimedia Foundation ConfirmEdit. This vulnerability is associa... Vulnerability in Wikimedia Foundation ConfirmEdit. This vulnerability is associated with program files includes/FancyCaptcha/ApiFancyCaptchaReload.Php. This issue affects ConfirmEdit: *. Scope: local bookworm: resolved (fixed in 1:1.39.17-1~deb12u1) bullseye: resolved (fixed in 1:1.35.13-1+deb11u5) forky: resolved (fixed in 1:1.43.5+dfsg-1) sid: resolved (fixed in

CVE-2008-4408 [MEDIUM] CVE-2008-4408: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.1, 1.12.0, and possib... Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.1, 1.12.0, and possibly other versions before 1.13.2 allows remote attackers to inject arbitrary web script or HTML via the useskin parameter to an unspecified component. Scope: local bookworm: resolved (fixed in 1:1.13.2-1) bullseye: resolved (fixed in 1:1.13.2-1) forky: resolved (fixed in 1:1.13.2-1) sid

CVE-2025-61654 [NONE] CVE-2025-61654: mediawiki - Vulnerability in Wikimedia Foundation Thanks. This vulnerability is associated w... Vulnerability in Wikimedia Foundation Thanks. This vulnerability is associated with program files includes/ThanksQueryHelper.Php. This issue affects Thanks: from * before 1.43.4, 1.44.1. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 1:1.43.5+dfsg-1) sid: resolved (fixed in 1:1.43.5+dfsg-1) trixie: resolved (fixed in 1:1.43.6+dfsg-1~d