Maniphest Advanced Search

Advanced Search
Use Results
Edit Query
Hide Query

Query

Assigned To

Tags

In Any: Vuln-CSRF In Any: Vuln-Infoleak In Any: Vuln-Inject In Any: Vuln-XSS

Authors

Subscribers

Statuses

Priorities

Subtypes

Open Parents

Open Subtasks

Group By

Order By

Spaces

Due Date After

Due Date Before

Other Assignee

Reference

Release Version

Release Date After

Release Date Before

Request ID

Phatality ID

Final Story Points

Created After

Created Before

Updated After

Updated Before

Closed After

Closed Before

Closed By

Page Size

Unbreak Now! (21)

T334895 XSS via Graph extension
Security
·
Security-Team
Security
MediaWiki-extensions-Graph
Vuln-XSS
Editing-team
WMDE-TechWish-Sprint-2023-04-05
SecTeam-Processed
SecTeam-wikimedia-project-event
May 15 2023, 9:01 PM
Assigned: Jdlrobson
T312506 Mailman3 XSS via username on hyperkitty tags API (CVE-2018-25045)
Security
·
Security-Team
Security
Wikimedia-Mailing-lists
Vuln-XSS
SecTeam-Processed
SRE
Jul 19 2022, 7:35 PM
Assigned: jhathaway
T297322 CVE-2021-44857, CVE-2021-44858: Unauthorized users can undo edits on any protected page and view contents of private wikis using mcrundo
Security
·
Security-Team
Security
Vuln-Infoleak
Wikimedia-Incident
Platform Team Initiatives (MCR)
MediaWiki-General
MW-1.35-notes
MW-1.36-notes
MW-1.37-notes
MW-1.38-notes (1.38.0-wmf.18; 2022-01-17)
Dec 15 2021, 7:53 PM
Assigned: Legoktm
T189489 logstash-beta: stop exposing IP addresses to the public
Cloud-Services
cloud-services-team
Beta-Cluster-Infrastructure
Privacy
Vuln-Infoleak
Mar 12 2018, 10:59 PM
T176101 Cannot delete File:MKC,S.jpg on zhwiki due to DBQueryError
PRODUCTION ERROR
·
MediaWiki-Page-deletion
Chinese-Sites
Wikimedia-production-error
Vuln-Inject
Sep 19 2017, 5:31 AM
Assigned: Anomie
T171405 Cannot suppress pages while deleting following change to page deletion interface
MediaWiki-Page-deletion
Regression
Vuln-Infoleak
Security-Core
MediaWiki-Revision-deletion
Patch-For-Review
MW-1.30-release-notes (WMF-deploy-2017-07-18_(1.30.0-wmf.10))
Security
Jul 23 2017, 11:30 PM
Assigned: Legoktm
T139236 Phabricator needs update: Security issue
Phabricator
SRE
Vuln-XSS
Security
Jul 2 2016, 2:25 PM
T139234 Phabricator XSS vulnerability
Phabricator
SRE
Vuln-XSS
Security
Jul 2 2016, 7:23 PM
Assigned: • mmodell
T119707 XSS: MobileFrontend fails to apply escaping to page titles and wikibase labels when using them as fallback for displaytitle
Wikidata
MobileFrontend
Vuln-XSS
Reading Web Sprint 61 - Cold Hard Cache
Security
Mar 16 2016, 6:05 AM
Assigned: daniel
T109724 A combination of Special:MyPage redirects and pagecounts allows an external site to know the wikipedia login of an user
Privacy
Security-Team
MW-1.24-release
MW-1.23-release
MW-1.26-release
MW-1.25-release
MediaWiki-Redirects
MW-1.27-release-notes
Vuln-Infoleak
Security
Nov 19 2015, 10:32 PM
Assigned: • csteipp
T109638 Page categorization logs expose user's IP
MediaWiki-Recent-changes
Security-Core
Vuln-Infoleak
Security-Team
Security
Sep 1 2015, 6:14 PM
Assigned: • csteipp
T103391 Reflected XSS vulnerabilities in Semantic Forms
MediaWiki-extensions-Page_Forms
Security-Team
Vuln-XSS
Security
Jul 7 2015, 11:47 PM
Assigned: • csteipp
T85113 Function names aren't sanitized in Lua error backtraces
Scribunto
Vuln-XSS
Security
Jan 20 2015, 11:15 PM
Assigned: • csteipp
T73394 XSS in language converter when used with Html class's tricky escaping
Security-Core
Patch-For-Review
MediaWiki-Core-Team
Vuln-XSS
Security
Mar 28 2015, 5:22 AM
Assigned: • csteipp
T68608 XSS in mediawiki.page.image.pagination.js
MW-1.24-release
MediaWiki-User-Interface
Vuln-XSS
Security
Feb 20 2020, 8:11 PM
T62339 Reported RCE in djvu thumbnailing
MediaWiki-File-management
Multimedia
Vuln-Inject
Commons
Security
Feb 20 2020, 8:11 PM
T60088 [Regression] Sanitizer::checkCss blacklist can be bypassed using fullwidth backslash
MediaWiki-Parser
Vuln-XSS
Security
Feb 20 2020, 8:11 PM
T59550 SVG XSLT XSS
MediaWiki-Uploading
Multimedia
Vuln-XSS
Security
Feb 20 2020, 8:11 PM
T58699 TimedMediaHandler allows for stored XSS
TimedMediaHandler
Multimedia
Vuln-XSS
Security
Feb 20 2020, 8:11 PM
T39622 Correctly escape uselang attribute to prevent xss in Extension:Translate
MediaWiki-extensions-Translate
Vuln-XSS
Security
Feb 20 2020, 8:11 PM
Assigned: Nikerabbit
T30534 XSS in MediaWiki API (through invalid property name)
MediaWiki-General
Vuln-XSS
Security
Feb 20 2020, 8:11 PM
Assigned: tstarling

Needs Triage (62)

T361448 GuMaxDD skin: stored XSS via MediaWiki:Sidebar
Security
·
Security
Vuln-XSS
MediaWiki-skins-GuMaxDD
SecTeam-Processed
security-bug
Tue, Apr 16, 4:59 AM
Assigned: ashley
T361365 Challenge: stored XSS on four challenge fields
Security
·
Security-Team
Security
Challenge
Social-Tools
Vuln-XSS
Mar 31 2024, 4:19 AM
Assigned: ashley
T357203 XSS through interface message in UnlinkedWikibase
Security
·
Security-Team
Security
affects-Miraheze
MediaWiki-extensions-UnlinkedWikibase
SecTeam-Processed
Vuln-XSS
Mon, Apr 29, 9:23 AM
Assigned: Samwilson
T354045 API incorrectly marks formatted html output as public cacheable even though it contains csrf token
Security
·
Security
MediaWiki-Action-API
SecTeam-Processed
Vuln-Infoleak
MediaWiki-Engineering
MW-1.42-notes (1.42.0-wmf.14; 2024-01-16)
MW-Interfaces-Team
MW-1.39-notes
MW-1.40-notes
MW-1.41-notes
Jan 24 2024, 3:20 PM
Assigned: Mstyles
T353138 CVE-2024-23175: FlexDiagrams XSS bug
Security
·
MediaWiki-extensions-FlexDiagrams
Security
security-bug
Vuln-XSS
SecTeam-Processed
Dec 14 2023, 2:22 PM
Assigned: Yaron_Koren
T345693 CVE-2023-45373: ProofreadPage Security-XSS errors in CI
Security
·
Security-Team
Security
ProofreadPage
SecTeam-Processed
Vuln-XSS
MW-1.41-notes (1.41.0-wmf.29; 2023-10-03)
Oct 10 2023, 4:00 PM
Assigned: Mstyles
T345165 Move the time limit check before the permissions check
Security
·
Security
CheckUser
Vuln-Infoleak
SecTeam-Processed
Anti-Harassment (AHaT Sprint 32 - Baseball Cap)
MW-1.41-notes (1.41.0-wmf.26; 2023-09-12)
http-client-hints (Release 0 (Pilot wikis))
Sep 26 2023, 7:11 PM
Assigned: Dreamy_Jazz
T344359 CVE-2023-45369: pagetriagelist API leaks suppressed usernames
Security
·
Security-Team
Security
PageTriage
Vuln-Infoleak
SecTeam-Processed
Moderator-Tools-Team (Kanban)
Oct 10 2023, 2:30 PM
Assigned: Soda
T331321 CVE-2023-29133: XSS in Searchtext formatter in Cargo
Security
·
Security-Team
Security
MediaWiki-extensions-Cargo
Vuln-XSS
Mar 11 2023, 3:06 AM
Assigned: Yaron_Koren
T331065 CVE-2023-37254: Extension:Cargo XSS in Special:CargoQuery using default format
Security
·
Security-Team
Security
MediaWiki-extensions-Cargo
Vuln-XSS
Mar 6 2023, 9:06 PM
Assigned: Yaron_Koren
T326866 Special:Investigate can expose suppressed information for log events
BUG REPORT
·
Security
Vuln-Infoleak
Anti-Harassment
SecTeam-Processed
CheckUser
Wed, Apr 10, 1:41 PM
T323651 CVE-2023-37304: XSS in DoubleWiki extension (Wikisource)
Security
·
Security-Team
Security
MediaWiki-extensions-DoubleWiki
Vuln-XSS
Platform Engineering
SecTeam-Processed
Jun 30 2023, 7:31 PM
Assigned: matmarex
T318622 Bodh Toolforge OAuth consumer was world-readable
Toolforge
Security
Vuln-Infoleak
Tool-bodh
Dec 15 2022, 11:35 PM
T313351 Upgrade mailing list servers to bullseye
Security-Team
Security
Wikimedia-Mailing-lists
Vuln-XSS
SRE
Jul 19 2022, 7:59 PM
Assigned: jhathaway
T306815 Nimbus skin: XSS via the "Advertise" link interface messages (CVE-2022-29907)
Security
·
Security
Nimbus
Vuln-XSS
SecTeam-Processed
Apr 27 2022, 2:16 PM
Assigned: ashley
T306741 FanBoxes: classic CSRF in Special:UserBoxes
Security
·
Security
Social-Tools
FanBoxes
Vuln-CSRF
SecTeam-Processed
Apr 26 2022, 3:21 PM
Assigned: ashley
T298871 XSS in WDQS UI result view explore button
Security
·
Security
Wikidata Query UI
Wikidata
Vuln-XSS
SecTeam-Processed
Feb 10 2022, 7:13 PM
Assigned: Lucas_Werkmeister_WMDE
T298839 XSS in WDQS query helper
Security
·
Security
Wikidata Query UI
Wikidata
Vuln-XSS
SecTeam-Processed
Feb 10 2022, 7:13 PM
Assigned: Lucas_Werkmeister_WMDE
T297423 Lockdown's partial page restrictions can be bypassed via undo
Security
·
Security-Team
Security
MediaWiki-extensions-Lockdown
Vuln-Infoleak
SecTeam-Processed
Dec 9 2021, 6:37 PM
T287542 API action=parse&prop=headhtml leaking user tokens and other private info in cross-origin requests (again)
Security
·
Security-Team
Security
MediaWiki-Action-API
Vuln-CSRF
Vuln-Infoleak
Regression
Platform Engineering
SecTeam-Processed
Aug 10 2021, 6:31 PM
Assigned: Legoktm
T286413 ISA tool is missing CSRF protection
Security
·
Security
ISA
Vuln-CSRF
Toolforge
SecTeam-Processed
Toolforge-standards-committee
User-Sebastian_Berlin-WMSE
Mar 4 2022, 9:55 AM
Assigned: Sebastian_Berlin-WMSE
T285515 CVE-2021-41798: XSS vulnerability in Special:Search
Security
·
Security-Team
Security
Vuln-XSS
MediaWiki-Search
Discovery-Search (Current work)
SecTeam-Processed
MW-1.35-notes
MW-1.37-notes
MW-1.36-notes
MW-1.31-release-notes
MW-1.38-notes (1.38.0-wmf.3; 2021-10-05)
Jul 26 2021, 12:20 PM
Assigned: Zabe
T284403 WikiLambda extension (wikilambda_edit action) is missing CSRF protection
Security
·
Security
WikiLambda
Vuln-CSRF
SecTeam-Processed
Abstract Wikipedia team
Jul 1 2021, 8:57 AM
Assigned: gengh
T283763 ircredirect.toolforge.org tool vulnerable to XSS
Security
·
Security
Tools
Vuln-XSS
SecTeam-Processed
Jun 1 2021, 2:31 PM
Assigned: Ahecht
T283283 Command injection in wikibugs because of outdated irc3 dependency
Security
·
Security-Team
Security
Wikibugs
Vuln-Inject
May 30 2021, 5:45 AM
Assigned: Legoktm
T281043 Stored XSS in various SystemGifts-related special pages (e.g. Special:SystemGiftManager, Special:ViewSystemGifts) (CVE-2021-36130)
Security
·
Security
SocialProfile
Vuln-XSS
SecTeam-Processed
Social-Tools
May 16 2021, 8:36 PM
Assigned: ashley
T279009 Cleanup duplicate indices in cloudelastic
Tool-global-search
Security
Vuln-Infoleak
SecTeam-Processed
Discovery-Search (Current work)
MW-1.37-notes (1.37.0-wmf.4; 2021-05-04)
May 19 2021, 2:54 PM
Assigned: EBernhardson
T277756 tools-puppetmaster-02 allows any toolforge user to log in and view secrets
Security
·
Security-Team
Security
cloud-services-team (Kanban)
Toolforge
SecTeam-Processed
Vuln-Infoleak
Mar 18 2021, 4:20 PM
Assigned: • Bstorm
T276306 CVE-2021-30156: Special:Contributions toolbar reveals existence of hidden users
Security
·
Security-Team
Security
Vuln-Infoleak
MediaWiki-Blocks
MediaWiki-Special-pages
User-Majavah
MW-1.37-notes (1.37.0-wmf.1; 2021-04-13)
MW-1.36-notes
Apr 6 2021, 10:06 PM
Assigned: taavi
T268641 PushToWatch: classic CSRF (CVE-2020-35626)
Security
·
Security-Team
Security
MediaWiki-extensions-PushToWatch
Vuln-CSRF
Nov 25 2020, 10:44 PM
Assigned: ashley
T266508 PollNY: Stored XSS (CVE-2020-29003)
Security
·
Security
Vuln-XSS
PollNY
Social-Tools
Nov 16 2020, 6:35 PM
Assigned: ashley
T266400 RandomGameUnit: Stored XSS (CVE-2020-27957)
Security
·
Security
RandomGameUnit
Vuln-XSS
Social-Tools
Oct 26 2020, 4:23 AM
Assigned: ashley
T260455 Suppressed username included in the Wiki Replicas
Security
·
Security-Team
Security
Data-Services
Vuln-Infoleak
MediaWiki-extensions-CentralAuth
Nov 13 2020, 2:59 AM
T250612 Language::translateBlockExpiry escapes HTML inconsistently
Security
MediaWiki-Internationalization
Vuln-XSS
Jun 24 2021, 11:57 AM
T242689 SocialProfile: classic CSRF (no token check) in various special pages which perform write actions
Security
·
Security-Team
SocialProfile
Vuln-CSRF
Social-Tools
Security
Feb 20 2020, 3:14 PM
Assigned: ashley
T239813 Cross Site Scripting on Swis.wmflabs.org
Cloud-VPS
Upstream
Vuln-XSS
Security
Dec 4 2019, 3:09 PM
Assigned: Slevinski
T224240 Deleting a log entry actor doesn't always hide the actor entirely
Thanks
MediaWiki-Revision-deletion
User-DannyS712
Growth-Team
Vuln-Infoleak
User-Urbanecm
Patch-For-Review
MW-1.34-notes (1.34.0-wmf.13; 2019-07-09)
Security
Jul 12 2019, 10:17 PM
Assigned: Urbanecm
T208280 SQL injection in CopyPatrol
CopyPatrol
Community-Tech
Security
Vuln-Inject
Nov 21 2018, 11:39 PM
Assigned: Catrope
T202249 XSS in YotpoReviews tag hook
MediaWiki-extensions-Other
Vuln-XSS
Security
Sep 1 2018, 12:23 PM
Assigned: Bawolff
T200014 Potential security bug in tests/qunit/data/load.mock.php
Vuln-XSS
MediaWiki-ResourceLoader
Performance-Team
Security
Jan 25 2019, 11:08 PM
T198984 xss wp-world toolforge
Vuln-XSS
Toolforge
Security
Jul 6 2018, 10:58 PM
T194726 Cargo SQL injection on Special:Drilldown
Security
·
MediaWiki-extensions-Cargo
Security
Vuln-Inject
Feb 11 2019, 3:31 PM
Assigned: Yaron_Koren
T190759 XSS in erwin85 relatedchanges
Tool-Erwin's-tools
Vuln-XSS
Security
Jul 10 2018, 12:14 AM
Assigned: Bawolff
T188474 SQLinjection in Extension:Cargo CREATE TABLE
MediaWiki-extensions-Cargo
Vuln-Inject
Security
Mar 2 2018, 6:17 PM
Assigned: Yaron_Koren
T187638 When a log event is (partially) hidden Special:Redirect/logid can link to the incorrect log and reveal hidden information (CVE-2018-0504)
MediaWiki-Special-pages
MediaWiki-Revision-deletion
Vuln-Infoleak
Patch-For-Review
Security
Jul 7 2018, 5:29 PM
Assigned: Samwilson
T184354 XSS vulnerability on wikipedia.de
Vuln-XSS
WMDE-FUN-Team
WMDE-Fundraising-Sprint-17
Feb 16 2018, 10:54 AM
T171045 XSS in SocialProfile's UserBoard
Social-Tools
SocialProfile
Vuln-XSS
Security
Jul 25 2017, 2:32 AM
Assigned: ashley
T166997 XSS in MediaWikiChat extension
MediaWikiChat
Vuln-XSS
Security
Jul 27 2018, 8:38 PM
Assigned: ashley
T152884 SQL injection point in BlogPage::getEditorsList() *and* BlogPage::getVotersList()
BlogPage
Social-Tools
Vuln-Inject
Security
Dec 19 2016, 8:39 PM
Assigned: ashley
T140752 Non-persistent XSS - tools.wmflabs.org/pageviews
Tool-Pageviews
Vuln-XSS
Security
Jul 22 2016, 5:39 AM
Assigned: MusikAnimal
T125319 Weird revdelete behaviour
Security-Other
Vuln-Infoleak
Security
Jan 30 2016, 10:30 PM
Assigned: Krenair
T120562 AbuseFilter reveals hit count even without appropriate rights
AbuseFilter
Vuln-Infoleak
MW-1.29-release (WMF-deploy-2016-12-13_(1.29.0-wmf.6))
Security
Dec 11 2016, 8:16 PM
Assigned: matej_suchanek
T108198 XSS in GeSHi/contrib/cssgen.php
Vuln-XSS
Security-Extensions
Security
Aug 6 2015, 6:01 PM
Assigned: • csteipp
T103765 Ex:SemanticForms - Stored XSS in template label on Special:FormEdit
Security-Extensions
MediaWiki-extensions-Page_Forms
Vuln-XSS
Security
Jul 7 2015, 11:42 PM
Assigned: Yaron_Koren
T103761 Ex:SemanticForms - Stored XSS in CreateForm + hostile template
Security-Extensions
MediaWiki-extensions-Page_Forms
Vuln-XSS
Security
Jul 7 2015, 11:52 PM
Assigned: Yaron_Koren
T93365 wbmergeitems doesn't need a token to merge items
Wikidata
Vuln-CSRF
Security
Mar 23 2015, 3:39 PM
Assigned: hoo
T89745 Stored XSS in PDF files
Vuln-XSS
Security
Apr 20 2015, 5:21 PM
Assigned: • csteipp
T88964 Arbitrary HTML output possible
MediaWiki-extensions-Widgets
Security-Extensions
Vuln-XSS
Security
Apr 29 2015, 3:29 AM
Assigned: Majr
T85858 Check User page lacks CSRF protection
CheckUser
Vuln-CSRF
Security
Jan 20 2015, 11:12 PM
Assigned: • csteipp
T70187 Mitigate CVE-2014-4671 (jsonp flash)
MW-1.24-release
MediaWiki-Action-API
Vuln-XSS
Security
Oct 16 2020, 5:40 PM
T57991 XSS in https://ha.m.wikipedia.org/
ZeroBanner
Zero
Vuln-XSS
Security
Feb 20 2020, 8:14 PM
T41762 XSS issue in image syntax
MediaWiki-Parser
Vuln-XSS
Security
Feb 20 2020, 8:14 PM

High (17)

T346311 [builds-api] Harbor secret is public if using env vars, move it to a Secret resource
Security
·
Security
User-aborrero
cloud-services-team (FY2023/2024-Q1-Q2)
SecTeam-Processed
Vuln-Infoleak
Sep 14 2023, 10:46 AM
Assigned: dcaro
T343709 Wikifunctions Kubernetes evaluator service exposes some sensitive data/functions within the container
Security
·
Security-Team
Security
Wikifunctions
Vuln-Infoleak
Abstract Wikipedia team
SecTeam-Processed
serviceops-radar
Nov 6 2023, 10:57 PM
Assigned: cmassaro
T342487 [Event Platform] Actor performing suppression revealed publicly
Security
·
Security
Vuln-Infoleak
Event-Platform
Privacy Engineering
SecTeam-Processed
MW-1.42-notes (1.42.0-wmf.7; 2023-11-28)
Data-Engineering (Sprint 6)
Jan 8 2024, 7:50 PM
Assigned: Ottomata
T339111 CVE-2023-37302: Style injection into badges on Wikidata due to unescaped quotes
Security
·
Security-Team
Security
Wikidata
Vuln-XSS
Wikidata Dev Team (Sprint-∞)
SecTeam-Processed
Jun 30 2023, 5:51 PM
Assigned: Mstyles
T338094 Dom based reflected XSS at https://api.wikimedia.org/service/linkrecommendation/apidocs/
Security
·
Security-Team
Security
Vuln-XSS
Add-Link
Upstream
Growth-Team (Sprint 0 (Growth Team))
SecTeam-Processed
Vuln-VulnComponent
Patch-For-Review
Jun 13 2023, 7:35 PM
Assigned: kostajh
T332598 changeprop-jobqueue password leaked on phabricator
Security
·
Security
serviceops
SecTeam-Processed
Vuln-Infoleak
Mar 27 2023, 4:23 PM
Assigned: akosiaris
T331192 CVE-2023-29135: CheckUser 'get users' form vulnerable to HTML injection through usernames
Security
·
CheckUser
Security
Security-Team
Vuln-Inject
SecTeam-Processed
Vuln-XSS
Patch-For-Review
Apr 4 2023, 4:16 PM
Assigned: Mstyles
T328643 CVE-2023-29137: GrowthExperiments: UserImpactHandler returns timezone preference data for arbitrary users
Security
·
Security-Team
Security
Growth-Team (Sprint 0 (Growth Team))
GrowthExperiments-ImpactModule
Vuln-Infoleak
SecTeam-Processed
MW-1.40-notes (1.40.0-wmf.24; 2023-02-20)
Feb 28 2023, 1:36 AM
Assigned: kostajh
T328127 Analyze possible bot traffic for enwiki article Index (statistics), Index & XXX:_Return_of_Xander_Cage
Wikipedia-iOS-App-Backlog
Security
Pageviews-Anomaly
Vuln-Infoleak
Data-Engineering-Planning
Data Pipelines
SecTeam-Processed
Wikipedia-Android-App-Backlog (Android Release - FY2023-24)
iOS Release FY2023-24 (Archive)
Product-Analytics (Kanban)
Feb 28 2023, 5:48 PM
Assigned: SNowick_WMF
T326865 Special:CheckUser can expose suppressed information for log events
BUG REPORT
·
Security
Vuln-Infoleak
SecTeam-Processed
CheckUser
Trust and Safety Product Sprint (Sprint Tabla (1st - 14th April))
Trust and Safety Product Team
MW-1.43-notes (1.43.0-wmf.1; 2024-04-16)
Tue, Apr 16, 11:21 AM
Assigned: Dreamy_Jazz
T320785 XSS in Special:Search
Security
·
Security-Team
Security
Vuln-XSS
MediaWiki-Search
Discovery-Search
MW-1.40-notes (1.40.0-wmf.6; 2022-10-17)
Oct 14 2022, 2:39 PM
Assigned: dcausse
T318387 Link recommendation service tries to execute HTML page as SQL
Security
·
Security-Team
Security
Vuln-Inject
Add-Link
Growth-Team (Sprint 0 (Growth Team))
SecTeam-Processed
Sep 30 2022, 2:48 PM
Assigned: kostajh
T309757 Public Phabricator dump includes restricted project columns
Security
·
Security
Phabricator
Dumps-Generation
Vuln-Infoleak
SecTeam-Processed
Release-Engineering-Team (Doing)
Sep 6 2022, 6:28 PM
Assigned: hashar
T306327 cabalbot oauth consumer secret publicly visible
Security
·
Security
Tools
SecTeam-Processed
Vuln-Infoleak
Apr 18 2022, 11:54 PM
T304354 It is impossible to oversight who has reviewed a revision via FlaggedRevs (CVE-2022-28212)
Security
·
MediaWiki-extensions-FlaggedRevs
Security
Security-Team
Vuln-Infoleak
SecTeam-Processed
MW-1.39-notes (1.39.0-wmf.6; 2022-04-04)
Mar 31 2022, 5:44 PM
Assigned: Mstyles
T302192 Data fields in Commons tabular datasets allow running arbitrary JS (CVE-2022-28210)
Security
·
Security-Team
Security
JsonConfig
Vuln-XSS
SecTeam-Processed
Patch-For-Review
MW-1.39-notes (1.39.0-wmf.6; 2022-04-04)
Mar 31 2022, 5:42 PM
Assigned: Lucas_Werkmeister_WMDE
T297574 CVE-2021-45038: Unauthorized users can access private wiki contents using rollback action
Security
·
Security-Team
Security
Vuln-Infoleak
MediaWiki-General
Patch-For-Review
MW-1.35-notes
MW-1.38-notes (1.38.0-wmf.16; 2022-01-03)
MW-1.36-notes
MW-1.37-notes
Dec 15 2021, 7:54 PM
Assigned: Legoktm