Maniphest Security Team (In Progress) But Closed or Stalled

Security Team (In Progress) But Closed or Stalled
Use Results
Edit Query
Hide Query

	N/A
	Informational
	Low
	Medium
	High
	Critical

Closed, Declined (1)

T343369 Request new Wikimedia production environment for production risk assessment dashboard
production-risk-assessment
Security Team AppSec
Security-Team
Security
user-sbassett
SecTeam-Processed
Oct 12 2023, 4:56 PM

Closed, Duplicate (1)

T305713 Create a basic product API to MySQL/MariaDB ETL
Security-Team
Security
SecTeam-Processed
iPoid-Service
May 31 2022, 7:28 PM
Assigned: STran

Closed, Invalid (1)

T317234 Test ticket for appsec phab bot
Security-Team
Dec 20 2022, 1:14 PM
Assigned: Mstyles

Closed, Resolved (41)

T359553 Granting acl*security_steward access for 2024 Stewards and removing departing members
Security-Team
Stewards-and-global-tools
Security
SecTeam-Processed
Mar 21 2024, 10:32 PM
Assigned: sbassett
T344509 Security Issue Access Request for (Kappakayala)
Security
Security-Team
SecTeam-Processed
Feb 20 2024, 5:25 PM
Assigned: mmartorana
T335288 CVE-2021-46743: firebase/php-jwt Key/algorithm type confusion
Security
·
Security-Team
Security
MediaWiki-Vendor
SecTeam-Processed
Vuln-VulnComponent
Sep 25 2023, 10:28 PM
Assigned: Reedy
T330086 CVE-2023-29142: OATHAuth allows replay attacks when MediaWiki is configured without ObjectCache; Insecure Default Configuration
Security
·
Security-Team
Security
MediaWiki-extensions-OATHAuth
SecTeam-Processed
Documentation
MW-1.35-release
MW-1.38-release
MW-1.39-release
MW-1.40-notes (1.40.0-wmf.25; 2023-02-27)
Mar 30 2023, 10:12 PM
Assigned: Reedy
T316304 CVE-2022-41767: reassignEdits doesn't update results in an IP range check on Special:Contributions
Security
·
Security-Team
Security
Vuln-Infoleak
MediaWiki-General
MW-1.35-release
MW-1.37-release
MW-1.38-release
Patch-For-Review
SecTeam-Processed
MW-1.39-release
Sep 29 2022, 5:39 PM
Assigned: Reedy
T312961 Allow registry.gitlab.com/security-products/**/* for gitlab shared runner docker images
GitLab (CI & Job Runners)
Security-Team
Release-Engineering-Team
user-sbassett
SecTeam-Processed
collaboration-services
Oct 20 2022, 11:07 AM
Assigned: Jelto
T309900 Determine initial wikis for production deployment of ext:StopForumSpam
Security
·
Security-Team
Security
user-sbassett
SecTeam-Processed
MediaWiki-extensions-StopForumSpam
Patch-For-Review
Aug 22 2022, 3:22 PM
Assigned: sbassett
T309894 CVE-2022-41765: HTMLUserTextField exposes existence of hidden users
Security
·
Security-Team
Security
MediaWiki-HTMLForm
Vuln-Infoleak
MediaWiki-extensions-CentralAuth
MW-1.38-release
MW-1.37-release
MW-1.35-release
MediaWiki-Blocks
Platform Engineering
Patch-For-Review
affects-Miraheze
…
Sep 29 2022, 5:55 PM
Assigned: matmarex
T295790 Add Manfredi Martorana to deployment and analytics-privatedata-users groups
Security-Team
SecTeam-Processed
SRE
SRE-Access-Requests
Nov 30 2021, 8:41 PM
Assigned: mmartorana
T290421 Security Issue Access Request for (@gabriel-wmde)
Security
Security-Team
SecTeam-Processed
Sep 16 2021, 4:13 PM
Assigned: • Dsharpe
T290420 Security Issue Access Request for (@thiemowmde)
Security
Security-Team
SecTeam-Processed
User-thiemowmde
WMDE-TechWish-Sprint-2021-09-15
Sep 17 2021, 12:17 PM
Assigned: • Dsharpe
T289292 Create Security Team group within gitlab.wikimedia.org
Security-Team
Security Team AppSec
Security
GitLab
Release-Engineering-Team (Done by Fri 03 Sep)
User-brennen
GitLab-Application-Security-Pipeline
Aug 23 2021, 8:37 PM
Assigned: brennen
T280045 Security Readiness Review For Diff Calendar
Security
Security-Team
Security Supplier Assessments
SecTeam-Processed
Apr 23 2021, 7:07 PM
Assigned: • Dsharpe
T278058 CVE-2021-30157: Unescaped messages used in HTML on ChangesList pages (e.g. RecentChanges and Watchlist)
Security
·
Security-Team
Security
Vuln-XSS
MediaWiki-Special-pages
MW-1.31-release
MW-1.35-release
SecTeam-Processed
MW-1.36-notes (1.36.0-wmf.36; 2021-03-23)
MW-1.35-notes
MW-1.31-release-notes
Mar 30 2021, 12:45 AM
Assigned: Grunny
T277379 OAuth doesn't validate length of oarc_grants and oarc_oauth2_allowed_grants JSON
Security
·
Security-Team
Security
MediaWiki-extensions-OAuth
SecTeam-Processed
Vuln-Misconfiguration
MW-1.40-notes (1.40.0-wmf.19; 2023-01-16)
Jan 17 2023, 12:54 AM
Assigned: Reedy
T277336 Element (Matrix client) Bridge Encryption - security review request
Security
Security Supplier Assessments
Security-Team
Apr 23 2021, 7:09 PM
Assigned: • Dsharpe
T274152 Special:AbuseFilter/examine reveals suppressed usernames (CVE-2021-31549)
Security
·
Security-Team
Security
AbuseFilter
Vuln-Infoleak
MW-1.36-notes (1.36.0-wmf.35; 2021-03-16)
Apr 13 2021, 1:17 AM
Assigned: Daimona
T257834 Create apache microsite for security.wikimedia.org
Security-Team
Sep 15 2020, 4:49 PM
Assigned: Reedy
T254925 Bot passwords for officewiki
Wikimedia-Site-requests
Security-Team
Jun 24 2020, 5:53 PM
Assigned: Reedy
T251784 Puppetize Peek for running in prod
Security-Team
May 29 2020, 3:24 PM
Assigned: • chasemp
T249337 Security Issue Access Request for hnowlan
Security
Security-Team
Apr 7 2020, 3:03 PM
Assigned: • Dsharpe
T247326 combine security readiness review and security preview boards with third tag
Application Security Reviews
Security Preview
Security
Security-Team
secscrum
Project-Admins
Mar 10 2020, 8:34 PM
Assigned: • chasemp
T247197 Investigate orch-chasemp-1.orch.eqiad.wmflabs not allowing SSH connections from cloud-cumin-01
Cloud-VPS
Security-Team
Mar 10 2020, 5:33 PM
Assigned: • chasemp
T246940 Revise and update Concept review service for Security Team
Security-Team
PM
Security Preview
secscrum
Mar 5 2020, 7:59 PM
Assigned: • chasemp
T246602 makeCollapsible allows applying event handler to any CSS selector (CVE-2020-10960)
Security
·
Security-Team
Security
MediaWiki-General
MW-1.31-release-notes
MW-1.34-notes
MW-1.33-notes
MW-1.35-notes (1.35.0-wmf.26; 2020-03-31)
Mar 24 2020, 5:13 PM
Assigned: sbassett
T246489 enable bot passwords on otrswiki
Wikimedia-Site-requests
Security-Team
Jul 19 2020, 6:17 PM
Assigned: Reedy
T245201 Update protect as security issue to use acl*security
Security-Team
Phabricator
Security
Feb 20 2020, 8:07 PM
Assigned: • mmodell
T244308 PHP Notice: Undefined offset: 8 from TOTPKey.php
Security
·
Security-Team
MediaWiki-extensions-OATHAuth
Wikimedia-production-error
Security
MW-1.35-notes (1.35.0-wmf.18; 2020-02-04)
Feb 10 2020, 11:27 PM
Assigned: ItSpiderman
T244165 Convert #Security to acl*Security
Security-Team
Phabricator
Security
Feb 20 2020, 8:45 PM
Assigned: • chasemp
T244156 Make NDA task filing more obvious/prominent
Phabricator
Security-Team
Security
Feb 24 2020, 8:23 PM
Assigned: • chasemp
T243608 User scripts shouldn't run on Special:Manage_Two-factor_authentication
Security
·
Security-Team
User-Urbanecm
Security
MW-1.35-notes (1.35.0-wmf.20; 2020-02-18)
Feb 18 2020, 2:48 PM
Assigned: Urbanecm
T242792 Update language in security review SOPs to establish timelines and expectations
Security-Team
PM
Feb 13 2020, 6:03 PM
Assigned: • Jcross
T242765 Create 'secteam-discussion' tag
Security-Team
PM
Phabricator
Jan 17 2020, 5:12 PM
Assigned: • chasemp
T242682 Write SOP for incoming email workflow for security@ and security-help@
Security-Team
PM
May 28 2020, 8:50 PM
Assigned: • Dsharpe
T242678 Configure security-help@ collab inbox group
Security-Team
PM
May 28 2020, 8:43 PM
Assigned: • Dsharpe
T240394 Write and send pre-release announcements for MediaWiki 1.31.7/1.33.3/1.34.1
MediaWiki-Releasing
Security
Security-Team
Mar 25 2020, 7:24 PM
Assigned: Reedy
T232932 User content can redirect the logout button to different URL (CVE-2020-10959)
MediaWiki-User-Interface
Security
Security-Team
MW-1.35-notes (1.35.0-wmf.26; 2020-03-31)
MW-1.34-notes
Mar 24 2020, 5:32 PM
Assigned: sbassett
T232568 Special:UserRights exposes the existence of hidden users (CVE-2020-25813)
Security
·
MediaWiki-User-management
User-DannyS712
Security
Security-Team
Vuln-Infoleak
MW-1.34-notes
MW-1.35-notes
Aug 11 2020, 9:04 PM
Assigned: DannyS712
T230951 Transfer ownership of mediawiki-security mailman list to Security Team
SRE
Wikimedia-Mailing-lists
Security-Team
Feb 25 2020, 9:10 PM
Assigned: • chasemp
T223654 AbuseFilterCheckMatch API reveals suppressed edits and usernames (CVE-2021-31547)
Vuln-Infoleak
Patch-For-Review
Security
AbuseFilter (Overhaul-2020)
Security-Team
MW-1.36-notes (1.36.0-wmf.35; 2021-03-16)
Apr 13 2021, 12:22 AM
Assigned: Daimona
T71617 AbuseFilter logs suppression deletions (CVE-2021-31546)
Vuln-Infoleak
Security
AbuseFilter (Overhaul-2020)
Patch-For-Review
Security-Team
User-Urbanecm
MW-1.36-notes (1.36.0-wmf.35; 2021-03-16)
Apr 13 2021, 12:47 AM
Assigned: Daimona

Open, Stalled (2)

T333722 Decommission #wikimedia-security IRC channel
Security
Security-Team
Jul 10 2023, 5:45 PM
Assigned: Reedy
T319318 Update and restructure public-facing wikimedia security documentation
Security-Team
Documentation
SecTeam-Processed
user-sbassett
Oct 12 2023, 8:46 PM

Security Team (In Progress) But Closed or StalledUse ResultsEdit QueryHide Query

Closed, Declined (1)

Closed, Duplicate (1)

Closed, Invalid (1)

Closed, Resolved (41)

Open, Stalled (2)

Security Team (In Progress) But Closed or Stalled
Use Results
Edit Query
Hide Query