mediawiki/core Security Advisories for 1.31.8 (5)
-
[MEDIUM] MediaWiki allows a denial of service
PKSA-qcmj-k84v-rjky CVE-2021-41800 GHSA-c8wv-qwwc-6j73
Affected version: <1.36.2
Reported by:
GitHub -
Non-jqueryMsg version of mw.message(…).parse() doesn't escape HTML
PKSA-z45m-sh5c-325v CVE-2020-25828
Affected version: >=1.31.0,<1.31.9|>=1.34.0,<1.34.3|>=1.34.99,<1.35.0
Reported by:
FriendsOfPHP/security-advisories -
mw.message.parse() accepts javascript: protocol in wikilinks
PKSA-2scp-v3wb-xcgz CVE-2020-25814
Affected version: >=1.31.0,<1.31.9|>=1.34.0,<1.34.3|>=1.34.99,<1.35.0
Reported by:
FriendsOfPHP/security-advisories -
Special:UserRights exposes the existence of hidden users
PKSA-d4kb-dkjp-1n1j CVE-2020-25813
Affected version: >=1.31.0,<1.31.9|>=1.34.0,<1.34.3
Reported by:
FriendsOfPHP/security-advisories -
TOTP throttle not enforced cross-wiki
PKSA-mshv-sn4g-n4ty CVE-2020-25827
Affected version: >=1.31.0,<1.31.9|>=1.34.0,<1.34.3
Reported by:
FriendsOfPHP/security-advisories