Description

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php.

Remediation

References

CVE-2016-6335

Related Vulnerabilities

WordPress 5.7.x PHP Object Injection (5.7 - 5.7.1)

Oracle JRE CVE-2024-20918 Vulnerability (CVE-2024-20918)

WordPress Plugin GraceMedia Media Player Local File Inclusion (1.0)

WordPress Plugin GiveWP-Donation and Fundraising Platform Multiple Cross-Site Scripting Vulnerabilities (2.17.2)

Ruby Other Vulnerability (CVE-2014-8080)

Severity

High

Classification

CVE-2016-6335 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities