Taavi

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions prior to 1.35.12 MediaWiki versions 1.36.x through 1.39.x before 1.39.5 MediaWiki versions 1.40.x before 1.40.1 **Description** The issue is related to cross-site scripting (XSS) in the `youhavenewmessagesmanyusers` and `youhavenewmessages` i18n messages, which is connected to the `MediaWiki:Youhavenewmessagesfromusers` message. This is due to improper neutralization of input during web page creation, allowing a remote attacker to perform cross-site scripting attacks. **Recommendations** For MediaWiki versions prior to 1.35.12, update to version 1.35.12 or later. For MediaWiki versions 1.36.x through 1.39.x, update to version 1.39.5 or later. For MediaWiki versions 1.40.x before 1.40.1, update to version 1.40.1 or later. As a temporary workaround, consider restricting access to the `youhavenewmessagesmanyusers` and `youhavenewmessages` i18n messages until a patch is available.

**Nome do software vulnerável e versões afetadas** Versões do MediaWiki anteriores à 1.31.12 Versões do MediaWiki 1.32.x a 1.35.1 **Descrição** Uma falha no MediaWiki permite que a página Special:Contributions revele a existência de um usuário “oculto”. **Recomendações** Para versões do MediaWiki anteriores à 1.31.12, atualize para a versão 1.31.12 ou posterior. Para versões do MediaWiki de 1.32.x a 1.35.1, atualize para a versão 1.35.2 ou posterior.