Maniphest Search

Search
Use Results
Edit Query
Hide Query

Query

Assigned To

	N/A
	Informational
	Low
	Medium
	High
	Critical

Closed, Declined (4)

T407666 Early access request for wiki.gg to pre-announce security fixes
Security-Team
Security
SecTeam-Processed
Oct 23 2025, 3:59 AM
Assigned: sbassett
T383772 User Enumeration via Forgot Password
Security
·
Security-Team
Security
MediaWiki-User-management
MW-1.44-release
MW-1.43-release
SecTeam-Processed
Jan 24 2025, 4:55 PM
T348780 Integrate a risk factor related to how many production projects an extension or skin is deployed
production-risk-assessment
Security-Team
Security Team AppSec
Security
Code-Health
SecTeam-Processed
Patch-For-Review
Dec 11 2024, 6:13 PM
Assigned: Mstyles
T343369 Request new Wikimedia production environment for production risk assessment dashboard
production-risk-assessment
Security Team AppSec
Security-Team
Security
user-sbassett
SecTeam-Processed
Oct 12 2023, 4:56 PM

Closed, Duplicate (2)

T377766 Create basic django models for initial release of the project
Security-Team
Security
Universal Security Dashboard
Nov 13 2024, 3:40 PM
T305713 Create a basic product API to MySQL/MariaDB ETL
Security-Team
Security
SecTeam-Processed
iPoid-Service
May 31 2022, 7:28 PM
Assigned: STran

Closed, Invalid (2)

T373433 load.php exhibits potential denial of service and timing attacks with certain parameters
Security
·
Security-Team
Security
Data-Persistence (work done)
SecTeam-Processed
Sep 9 2024, 3:51 PM
T317234 Test ticket for appsec phab bot
Security-Team
Dec 20 2022, 1:14 PM
Assigned: Mstyles

Closed, Resolved (60)

T410755 RCE via eval() in pywikibot during password parsing
Security
·
Security-Team
Security
Vuln-RCE
SecTeam-Processed
Pywikibot
Tue, Nov 25, 4:58 PM
Assigned: Xqt
T409259 Security Issue Access Request for Peter
Security
Security-Team
SecTeam-Processed
Sat, Nov 22, 11:26 PM
Assigned: Mstyles
T403291 CVE-2025-62656: GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS
Security
·
Security-Team
Security
Vuln-XSS
GlobalBlocking
Trust and Safety Product Team
Essential-Work
SecTeam-Processed
Trust and Safety Product Sprint (Sprint Dadar Gulung (September 8 - September 26))
MW-1.45-notes (1.45.0-wmf.18; 2025-09-09)
Sep 16 2025, 2:53 PM
Assigned: Dreamy_Jazz
T398852 Onboard Sérgio Lopes to the Security Team
Security-Team
SecTeam-Processed
Aug 4 2025, 3:22 PM
Assigned: mmartorana
T397524 CVE-2025-53501: Scribunto title.getContent() doesn't respect $wgNonincludableNamespaces
Security
·
Security-Team
Security
Scribunto
MediaWiki-extensions-Lockdown
Vuln-Infoleak
Jul 3 2025, 4:11 PM
Assigned: • Jly
T394721 CVE-2025-7363: XSS in TitleIcon
Security
·
Security-Team
Security
affects-Miraheze
MediaWiki-extensions-Title-Icon
Vuln-XSS
SecTeam-Processed
May 27 2025, 3:54 PM
Assigned: SomeRandomDeveloper
T392976 CVE-2025-53481: Denial of service vector on ipinfo/v0/norevision
Security
·
Security-Team
Security
Trust and Safety Product Team
IP Info
Vuln-DoS
Data-Persistence
Trust and Safety Product Sprint (Sprint Key Lime Pie (May 5 - May 23))
MW-1.45-notes (1.45.0-wmf.2; 2025-05-20)
May 25 2025, 6:52 PM
Assigned: STran
T390055 Security Issue Access Request for Dreamy Jazz
Security
Security-Team
SecTeam-Processed
Apr 2 2025, 5:04 PM
Assigned: Mstyles
T387130 CVE-2025-32699: Potential javascript injection attack enabled by Unicode normalization in Action API
Security
·
Security-Team
Security
MediaWiki-Action-API
Vuln-XSS
Vuln-Inject
SecTeam-Processed
Content-Transform-Team (Work In Progress)
Essential-Work
MW-Interfaces-Team
Patch-For-Review
Mar 24 2025, 3:04 PM
Assigned: cscott
T380306 Create basic specification (one-pager) and/or Decision Record Overview documents for USD
Security-Team
Security
Universal Security Dashboard
Jan 22 2025, 5:12 PM
Assigned: • acooper
T377905 VisualEditor's dompurify is vulnerable to CVE-2024-45801 and CVE-2024-47875
Security
·
Security-Team
Security
VisualEditor
Vuln-VulnComponent
SecTeam-Processed
MW-1.44-notes (1.44.0-wmf.2; 2024-11-05)
MediaWiki-Debian
Oct 14 2025, 4:53 PM
Assigned: sbassett
T373930 Requesting access to SRE related mailing list security@wikimedia.org
Security-Team
SecTeam-Processed
Sep 6 2024, 9:12 AM
Assigned: mmartorana
T371818 Investigate puppet configuration/profile for a stand-alone python/django application under wmcs bookworm instance
Security-Team
Security
Universal Security Dashboard
SecTeam-Processed
Oct 8 2024, 10:06 AM
Assigned: mmartorana
T370867 security@wikimedia.org access required for tappof
Security-Team
SecTeam-Processed
Jul 31 2024, 5:02 PM
Assigned: mmartorana
T370850 Security Issue Access Request for (tappof)
Security
Security-Team
SecTeam-Processed
Jul 31 2024, 10:37 AM
Assigned: mmartorana
T368224 Audit members of acl*security for more than 12 months of no activity (May 2025)
Phabricator
Security-Team
Security
SecTeam-Processed
Jun 24 2025, 4:00 PM
Assigned: • Jly
T363773 CVE-2024-40613: Evil regex used to process gadget definitions
Security
·
Security-Team
Security
Vuln-DoS
MediaWiki-extensions-Gadgets
SecTeam-Processed
security-bug
Patch-For-Review
Jul 10 2024, 8:55 AM
T359553 Granting acl*security_steward access for 2024 Stewards and removing departing members
Security-Team
Stewards-and-global-tools
Security
SecTeam-Processed
Mar 21 2024, 10:32 PM
Assigned: sbassett
T344509 Security Issue Access Request for (Kappakayala)
Security
Security-Team
SecTeam-Processed
Feb 20 2024, 5:25 PM
Assigned: mmartorana
T335288 CVE-2021-46743: firebase/php-jwt Key/algorithm type confusion
Security
·
Security-Team
Security
MediaWiki-Vendor
SecTeam-Processed
Vuln-VulnComponent
Sep 25 2023, 10:28 PM
Assigned: Reedy
T330086 CVE-2023-29142: OATHAuth allows replay attacks when MediaWiki is configured without ObjectCache; Insecure Default Configuration
Security
·
Security-Team
Security
MediaWiki-extensions-OATHAuth
SecTeam-Processed
Documentation
MW-1.35-release
MW-1.38-release
MW-1.39-release
MW-1.40-notes (1.40.0-wmf.25; 2023-02-27)
Mar 30 2023, 10:12 PM
Assigned: Reedy
T317341 Findings in Security Readiness Reviews of Trusted GitLab Runners
Security
·
GitLab (CI & Job Runners)
collaboration-services
Security
Security-Team
Vuln-Misconfiguration
SecTeam-Processed
Nov 17 2022, 3:17 PM
Assigned: Jelto
T316304 CVE-2022-41767: reassignEdits doesn't update results in an IP range check on Special:Contributions
Security
·
Security-Team
Security
Vuln-Infoleak
MediaWiki-General
MW-1.35-release
MW-1.37-release
MW-1.38-release
Patch-For-Review
SecTeam-Processed
MW-1.39-release
Sep 29 2022, 5:39 PM
Assigned: Reedy
T312961 Allow registry.gitlab.com/security-products/**/* for gitlab shared runner docker images
GitLab (CI & Job Runners)
Security-Team
Release-Engineering-Team
user-sbassett
SecTeam-Processed
collaboration-services
Oct 20 2022, 11:07 AM
Assigned: Jelto
T309900 Determine initial wikis for production deployment of ext:StopForumSpam
Security
·
Security-Team
Security
user-sbassett
SecTeam-Processed
MediaWiki-extensions-StopForumSpam
Patch-For-Review
Aug 22 2022, 3:22 PM
Assigned: sbassett
T309894 CVE-2022-41765: HTMLUserTextField exposes existence of hidden users
Security
·
Security-Team
Security
MediaWiki-HTMLForm
Vuln-Infoleak
MediaWiki-extensions-CentralAuth
MW-1.38-release
MW-1.37-release
MW-1.35-release
MediaWiki-Blocks
Platform Engineering
Patch-For-Review
affects-Miraheze
…
Sep 29 2022, 5:55 PM
Assigned: matmarex
T307523 Investigate container scanning options within the context of the Gitlab appsec pipeline
Security-Team
Security Team AppSec
Security
GitLab (CI & Job Runners)
SecTeam-Processed
GitLab-Application-Security-Pipeline
Jun 14 2024, 3:52 PM
Assigned: mmartorana
T295790 Add Manfredi Martorana to deployment and analytics-privatedata-users groups
Security-Team
SecTeam-Processed
SRE
SRE-Access-Requests
Nov 30 2021, 8:41 PM
Assigned: mmartorana
T290421 Security Issue Access Request for (@gabriel-wmde)
Security
Security-Team
SecTeam-Processed
Sep 16 2021, 4:13 PM
Assigned: • Dsharpe
T290420 Security Issue Access Request for (@thiemowmde)
Security
Security-Team
SecTeam-Processed
User-thiemowmde
WMDE-TechWish-Sprint-2021-09-15
Sep 17 2021, 12:17 PM
Assigned: • Dsharpe
T289292 Create Security Team group within gitlab.wikimedia.org
Security-Team
Security Team AppSec
Security
GitLab
Release-Engineering-Team (Done by Fri 03 Sep)
User-brennen
GitLab-Application-Security-Pipeline
Aug 23 2021, 8:37 PM
Assigned: brennen
T280045 Security Readiness Review For Diff Calendar
Security
Security Supplier Assessments
Security-Team
SecTeam-Processed
Apr 23 2021, 7:07 PM
Assigned: • Dsharpe
T278058 CVE-2021-30157: Unescaped messages used in HTML on ChangesList pages (e.g. RecentChanges and Watchlist)
Security
·
Security-Team
Security
Vuln-XSS
MediaWiki-Special-pages
MW-1.31-release
MW-1.35-release
SecTeam-Processed
MW-1.36-notes (1.36.0-wmf.36; 2021-03-23)
MW-1.35-notes
MW-1.31-release-notes
Mar 30 2021, 12:45 AM
Assigned: Grunny
T277379 OAuth doesn't validate length of oarc_grants and oarc_oauth2_allowed_grants JSON
Security
·
Security-Team
Security
MediaWiki-extensions-OAuth
SecTeam-Processed
Vuln-Misconfiguration
MW-1.40-notes (1.40.0-wmf.19; 2023-01-16)
Jan 17 2023, 12:54 AM
Assigned: Reedy
T277336 Element (Matrix client) Bridge Encryption - security review request
Security
Security Supplier Assessments
Security-Team
Apr 23 2021, 7:09 PM
Assigned: • Dsharpe
T274152 Special:AbuseFilter/examine reveals suppressed usernames (CVE-2021-31549)
Security
·
Security-Team
Security
AbuseFilter
Vuln-Infoleak
MW-1.36-notes (1.36.0-wmf.35; 2021-03-16)
Apr 13 2021, 1:17 AM
Assigned: Daimona
T257834 Create apache microsite for security.wikimedia.org
Security-Team
Sep 15 2020, 4:49 PM
Assigned: Reedy
T254925 Bot passwords for officewiki
Wikimedia-Site-requests
Security-Team
Jun 24 2020, 5:53 PM
Assigned: Reedy
T251784 Puppetize Peek for running in prod
Security-Team
May 29 2020, 3:24 PM
Assigned: • chasemp
T249337 Security Issue Access Request for hnowlan
Security
Security-Team
Apr 7 2020, 3:03 PM
Assigned: • Dsharpe
T247326 combine security readiness review and security preview boards with third tag
Application Security Reviews
Security Preview
Security
Security-Team
secscrum
Project-Admins
Mar 10 2020, 8:34 PM
Assigned: • chasemp
T247197 Investigate orch-chasemp-1.orch.eqiad.wmflabs not allowing SSH connections from cloud-cumin-01
Cloud-VPS
Security-Team
Mar 10 2020, 5:33 PM
Assigned: • chasemp
T246940 Revise and update Concept review service for Security Team
Security-Team
PM
Security Preview
secscrum
Mar 5 2020, 7:59 PM
Assigned: • chasemp
T246602 makeCollapsible allows applying event handler to any CSS selector (CVE-2020-10960)
Security
·
Security-Team
Security
MediaWiki-General
MW-1.31-release-notes
MW-1.34-notes
MW-1.33-notes
MW-1.35-notes (1.35.0-wmf.26; 2020-03-31)
Mar 24 2020, 5:13 PM
Assigned: sbassett
T246489 enable bot passwords on otrswiki
Wikimedia-Site-requests
Security-Team
Jul 19 2020, 6:17 PM
Assigned: Reedy
T245201 Update protect as security issue to use acl*security
Security-Team
Phabricator
Security
Feb 20 2020, 8:07 PM
Assigned: • mmodell
T244308 PHP Notice: Undefined offset: 8 from TOTPKey.php
Security
·
Security-Team
MediaWiki-extensions-OATHAuth
Wikimedia-production-error
Security
MW-1.35-notes (1.35.0-wmf.18; 2020-02-04)
Feb 10 2020, 11:27 PM
Assigned: ItSpiderman
T244165 Convert #Security to acl*Security
Security-Team
Phabricator
Security
Feb 20 2020, 8:45 PM
Assigned: • chasemp
T244156 Make NDA task filing more obvious/prominent
Phabricator
Security-Team
Security
Feb 24 2020, 8:23 PM
Assigned: • chasemp
T243608 User scripts shouldn't run on Special:Manage_Two-factor_authentication
Security
·
Security-Team
User-Urbanecm
Security
MW-1.35-notes (1.35.0-wmf.20; 2020-02-18)
Feb 18 2020, 2:48 PM
Assigned: Urbanecm
T242792 Update language in security review SOPs to establish timelines and expectations
Security-Team
PM
Feb 13 2020, 6:03 PM
Assigned: • Jcross
T242765 Create 'secteam-discussion' tag
Security-Team
PM
Phabricator
Jan 17 2020, 5:12 PM
Assigned: • chasemp
T242682 Write SOP for incoming email workflow for security@ and security-help@
Security-Team
PM
May 28 2020, 8:50 PM
Assigned: • Dsharpe
T242678 Configure security-help@ collab inbox group
Security-Team
PM
May 28 2020, 8:43 PM
Assigned: • Dsharpe
T240394 Write and send pre-release announcements for MediaWiki 1.31.7/1.33.3/1.34.1
MediaWiki-Releasing
Security
Security-Team
Mar 25 2020, 7:24 PM
Assigned: Reedy
T232932 User content can redirect the logout button to different URL (CVE-2020-10959)
MediaWiki-User-Interface
Security
Security-Team
MW-1.35-notes (1.35.0-wmf.26; 2020-03-31)
MW-1.34-notes
Mar 24 2020, 5:32 PM
Assigned: sbassett
T232568 Special:UserRights exposes the existence of hidden users (CVE-2020-25813)
Security
·
MediaWiki-User-management
User-DannyS712
Security
Security-Team
Vuln-Infoleak
MW-1.34-notes
MW-1.35-notes
Aug 11 2020, 9:04 PM
Assigned: DannyS712
T230951 Transfer ownership of mediawiki-security mailman list to Security Team
SRE
Wikimedia-Mailing-lists
Security-Team
Feb 25 2020, 9:10 PM
Assigned: • chasemp
T223654 AbuseFilterCheckMatch API reveals suppressed edits and usernames (CVE-2021-31547)
Vuln-Infoleak
Patch-For-Review
Security
AbuseFilter (Overhaul-2020)
Security-Team
MW-1.36-notes (1.36.0-wmf.35; 2021-03-16)
Apr 13 2021, 12:22 AM
Assigned: Daimona
T71617 AbuseFilter logs suppression deletions (CVE-2021-31546)
Vuln-Infoleak
Security
AbuseFilter (Overhaul-2020)
Patch-For-Review
Security-Team
User-Urbanecm
MW-1.36-notes (1.36.0-wmf.35; 2021-03-16)
Apr 13 2021, 12:47 AM
Assigned: Daimona

Open, Stalled (2)

T333722 Decommission #wikimedia-security IRC channel
Security
Security-Team
Jul 10 2023, 5:45 PM
Assigned: Reedy
T319318 Update and restructure public-facing wikimedia security documentation
Security-Team
Documentation
SecTeam-Processed
Tech-Docs-Team
Oct 9 2025, 8:15 AM

SearchUse ResultsEdit QueryHide Query

Closed, Declined (4)

Closed, Duplicate (2)

Closed, Invalid (2)

Closed, Resolved (60)

Open, Stalled (2)

Search
Use Results
Edit Query
Hide Query