| img_auth.php may leak private extension images into the public cacheCVE-2020-15005 · GHSA-XPV7-93CM-4MXV |
mediawiki/coreRed Hat OpenShift Container Platform 3.11/mediawiki |
ComposerRed Hat |
Medium
|
Fix reported |
|
| MediaWiki information disclosureCVE-2019-16738 · GHSA-7HWR-F745-5RWQVersion ranges need review. |
mediawiki/coreRed Hat OpenShift Container Platform 3.10/mediawiki |
ComposerRed Hat |
Medium
|
Fix reported |
|
| Mediawiki Improper Privilege ManagementCVE-2018-0503 · GHSA-MHFV-9H99-JWG7Version ranges need review. |
mediawiki/coreRed Hat OpenShift Container Platform 3.6/mediawiki123 |
ComposerRed Hat |
Medium
|
Fix reported |
|
| Mediawiki BotPassword can bypass CentralAuth's account lockCVE-2018-0505 · GHSA-5C6W-F4W2-2GRPVersion ranges need review. |
mediawiki/coreRed Hat OpenShift Container Platform 3.6/mediawiki123 |
ComposerRed Hat |
Medium
|
Fix reported |
|
| Mediawiki information disclosure vulnerabilityCVE-2018-0504 · GHSA-HR8V-F4G2-P66FVersion ranges need review. |
mediawiki/coreRed Hat OpenShift Container Platform 3.11/mediawiki |
ComposerRed Hat |
Medium
|
Fix reported |
|
| MediaWiki Special:UserRights exposes the existence of hidden usersCVE-2020-25813 · GHSA-C4RJ-WRMQ-52RJVersion ranges need review. |
mediawiki/coreRed Hat OpenShift Container Platform 3.11/mediawiki |
ComposerRed Hat |
Medium
|
Fix reported |
|
| MediaWiki Cross-site Scripting (XSS) vulnerabilityCVE-2020-25814 · GHSA-4VR7-M8P8-434HVersion ranges need review. |
mediawiki/coreRed Hat OpenShift Container Platform 3.11/mediawiki |
ComposerRed Hat |
Medium
|
Fix reported |
|
| MediaWiki Open Redirect vulnerabilityCVE-2020-10959 · GHSA-MQHW-WQ8P-VF5RVersion ranges need review. |
mediawiki/coreRed Hat OpenShift Container Platform 3.11/mediawiki |
ComposerRed Hat |
Medium
|
Fix reported |
|
| MediaWiki makeCollapsible allows applying event handler to any CSS selectorCVE-2020-10960 · GHSA-PFM2-MQWJ-GGM5Version ranges need review. |
mediawiki/coreRed Hat OpenShift Container Platform 3.11/mediawiki |
ComposerRed Hat |
Medium
|
Fix reported |
|
| mediawiki: divergent behavior for contributions and user pages of hidden users and missing usersCVE-2020-35480 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Low
|
No fix reported |
|
| mediawiki: potential XSS via the month messages such as MediaWiki:january through MediaWiki:december outputting Block LogsCVE-2020-35479 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Medium
|
No fix reported |
|
| mediawiki: potential XSS via MediaWiki:blanknamespace outputting Block LogsCVE-2020-35478 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Medium
|
No fix reported |
|
| mediawiki: unable to change visibility of log entries when MediaWiki:Mainpage uses Special:MyLanguageCVE-2020-35477 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Low
|
No fix reported |
|
| mediawiki: message recentchanges-legend-watchlistexpiry can contain raw htmlCVE-2020-35474 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Medium
|
No fix reported |
|
| mediawiki: messages userrights-expiry-current and userrights-expiry-none can contain raw htmlCVE-2020-35475 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Medium
|
No fix reported |
|
| mediawiki: action=protect lets users with 'protect' permission protect to higher protection levelCVE-2021-30152 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Medium
|
No fix reported |
|
| mediawiki: ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent pageCVE-2021-30155 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Medium
|
No fix reported |
|
| mediawiki: blocked users are unable to use Special:ResetTokensCVE-2021-30158 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Low
|
No fix reported |
|
| mediawiki: XSS due to unescaped messages used in HTML on ChangesList pagesCVE-2021-30157 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Medium
|
No fix reported |
|
| mediawiki: XSS due to unescaped messages used in HTML on Special:NewFilesCVE-2021-30154 |
Red Hat OpenShift Container Platform 3.11/mediawikiRed Hat OpenShift Container Platform 4/mediawiki |
Red Hat |
Medium
|
No fix reported |
|
