Filtered by vendor Wikimedia
Subscribe
Search
Total
5 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-30458 | 1 Wikimedia | 1 Parsoid | 2021-12-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS. | |||||
| CVE-2020-36324 | 1 Wikimedia | 1 Analytics-quarry-web | 2021-04-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type. | |||||
| CVE-2019-19328 | 1 Wikimedia | 1 Wikidata Query Gui | 2020-08-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT. | |||||
| CVE-2019-19327 | 1 Wikimedia | 1 Wikidata Query Gui | 2019-12-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT. | |||||
| CVE-2019-19329 | 1 Wikimedia | 1 Wikidata Query Gui | 2019-12-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT. | |||||