Wikimedia Foundation

Records256All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high19CVSS 7.0–8.9

Exploited now

Wikimedia Foundation records in CISA KEV

No Wikimedia Foundation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wikidata Query Gui 3 records LOW Parsoid 2 records LOW Wikimedia-extensions-css 2 records HIGH Analytics-quarry-web 1 record LOW Apex 1 record HIGH Campaignevents 1 record LOW Mediawiki-extensions-i18ntags 1 record LOW Mediawiki-extensions-uploadwizard 1 record LOW

Records

3 records in Wikidata Query Gui · all components

TI-2019-13941 CVE-2019-19329 · GHSA-h3jq-gxm5-vhxg

In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when…

LOW 30

In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0142 Published 2019-11-27 No fix listed CWE-79

TI-2019-13940 CVE-2019-19328 · GHSA-6jjr-vcqj-wfcm

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT…

LOW 29

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00854 Published 2019-11-27 No fix listed CWE-79

TI-2019-13939 CVE-2019-19327 · GHSA-69w7-r966-jx2w

ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07…

LOW 29

ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00854 Published 2019-11-27 No fix listed CWE-79

Open these records in search →

Critical	7
High	19
Medium	137
Low	49
No CVSS	44