https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-12T04:53:40.102418+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/CERTFR-2015-AVI-566 CERTFR-2015-AVI-566 — De multiples vulnérabilités ont été corrigées dans <span class="textit">Mediawiki</span>. Certaines d'entre elles perme… 2026-10-12T04:53:40.108501+00:00 CERTFR-2015-AVI-566 https://vulnerability.circl.lu/vuln/cnvd-2016-00111 cnvd-2016-00111 2026-10-12T04:53:40.108621+00:00 cnvd-2016-00111 https://vulnerability.circl.lu/vuln/fkie_cve-2015-8624 fkie_cve-2015-8624 2026-10-12T04:53:40.108643+00:00

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.

 https://vulnerability.circl.lu/vuln/ghsa-3h2m-jjrw-87hw GHSA-3h2m-jjrw-87hw 2026-10-12T04:53:40.108696+00:00

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.

 https://vulnerability.circl.lu/vuln/gsd-2015-8624 gsd-2015-8624 2026-10-12T04:53:40.108719+00:00 gsd-2015-8624 https://vulnerability.circl.lu/vuln/ubuntu-cve-2015-8624 Withdrawn: UBUNTU-CVE-2015-8624 2026-10-12T04:53:40.108732+00:00

Withdrawn by the publisher.

Affected: Ubuntu:18.04:LTS: mediawiki

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.