[MEDIUM] MediaWiki allows a denial of service

PKSA-qcmj-k84v-rjky CVE-2021-41800 GHSA-c8wv-qwwc-6j73

Affected version: <1.36.2

Reported by:
GitHub

[MEDIUM] makeCollapsible allows applying event handler to any CSS selector

PKSA-pvds-fsx9-62mq CVE-2020-10960 GHSA-pfm2-mqwj-ggm5

Affected version: >=1.31.0,<1.31.7|>=1.33.0,<1.33.3|>=1.34.0,<1.34.1

Reported by:
GitHub, FriendsOfPHP/security-advisories

Possible to circumvent title-blacklist

PKSA-cs63-3stv-1jvc CVE-2019-19709

Affected version: >=1.31.0,<1.31.6|>=1.32.0,<1.32.6|>=1.33.0,<1.33.2|>=1.33.99,<1.34.0

Reported by:
FriendsOfPHP/security-advisories

Exposed suppressed username via Special:Redirect

PKSA-2hm2-kzrp-dy4t CVE-2019-16738

Affected version: >=1.31.0,<1.31.4|>=1.32.0,<1.32.4|>=1.33.0,<1.33.1

Reported by:
FriendsOfPHP/security-advisories