Tstarling

The issue allows attackers to bypass the -dsafe protection mechanism via `output-def-lookup` or `output-def-scope`, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. In versions 2.24 and later, safe mode is removed, and the product no longer tries to block code execution when external files are used.

The issue concerns private wikis behind a caching server that use the img auth.php image authorization security feature. Due to mishandled Cache-Control and Vary headers, files may have been cached publicly, allowing any unauthorized user to view them. This results in the potential disclosure of protected information.

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.18.5 MediaWiki versions 1.19.x prior to 1.19.2 Description: The issue allows remote administrators to read a user block reason via a reblock attempt due to improper protection of user block metadata. Recommendations: For MediaWiki versions prior to 1.18.5, update to version 1.18.5 or later. For MediaWiki versions 1.19.x prior to 1.19.2, update to version 1.19.2 or later.

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.18.5 MediaWiki versions 1.19.x prior to 1.19.2 Description: The issue allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account. Recommendations: For MediaWiki versions prior to 1.18.5, update to version 1.18.5 or later. For MediaWiki versions 1.19.x prior to 1.19.2, update to version 1.19.2 or later.

Name of the Vulnerable Software and Affected Versions: MediaWiki CentralNotice extension versions 1.19.x through 1.19.8 MediaWiki CentralNotice extension versions 1.20.x through 1.20.7 MediaWiki CentralNotice extension versions 1.21.x through 1.21.2 Description: The issue allows remote attackers to authenticate as a created user due to the Cache-Control header setting to cache session cookies when a user is autocreated. Recommendations: For versions 1.19.x through 1.19.8, update to version 1.19.9 or later. For versions 1.20.x through 1.20.7, update to version 1.20.8 or later. For versions 1.21.x through 1.21.2, update to version 1.21.3 or later.

The issue allows remote attackers to obtain sensitive information by leveraging certain functions or extensions, such as the SpecialUpload::ajaxGetExistsWarning function, or extensions like CategoryTree, ExtTab, and InlineEditor, due to a lack of read permission checks for action=ajax requests.

The issue allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim. This is due to the failure of `api.php` to prevent the use of public caching headers for private data.

The issue allows remote authenticated users to conduct phishing attacks. This is achieved by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue. The problem arises from the software not properly handling a correctly authenticated but unintended login attempt.