Cross-Site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-Site Request Forgery CSRF via the delete parameter, due to insufficient verification of the origin of HTTP requests. Remediation Upgrade mediawiki/cargo to version 3.7 or higher. References - Gerrit Mediawiki - Wikimedia Phabricat...

CVE-2024-47847

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting XSS.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47846

Cross-Site Request Forgery CSRF vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47849

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47849

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47846

Cross-Site Request Forgery CSRF vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47847

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting XSS.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47847 Various XSSes found in Cargo

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting XSS.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47847 Various XSSes found in Cargo

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting XSS.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47847

The CVE-2024-47847 entry relates to an XSS vulnerability in the MediaWiki Cargo extension. Affected versions are MediaWiki Cargo 3.6.X prior to 3.6.1, where improper neutralization of input during web page generation enables cross-site scripting. The issue is documented across multiple sources (i...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection due to the improper neutralization of special elements such as backticks in SQL commands. Remediation Upgrade mediawiki/cargo to version 3.7 or higher. References - Gerrit Mediawiki - GitHub Commit - Wikimedia Phabricator...

CVE-2024-47846

CVE-2024-47846 affects the MediaWiki Cargo extension for MediaWiki 3.6.x prior to 3.6.1. The issue is a Cross‑Site Request Forgery (CSRF) vulnerability in Special:DeleteCargoTable and Special:SwitchCargoTable due to insufficient CSRF protection / origin verification on delete actions. The root ca...

CVE-2024-47846 Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Cross-Site Request Forgery CSRF vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47846 Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Cross-Site Request Forgery CSRF vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47849

CVE-2024-47849 affects the MediaWiki extension Cargo for MediaWiki 3.6.x prior to 3.6.1, caused by improper neutralization in SQL commands leading to SQL Injection. Public sources concur on versions to fix: update Cargo to 3.6.1 or later (Snyk lists 3.7+ as the remediation). Documented impact is ...

CVE-2024-47849 Backticks can allow the usage of not-allowed SQL functions

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47849 Backticks can allow the usage of not-allowed SQL functions

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

MediaWiki Cargo 安全漏洞

MediaWiki Cargo is an extension of the American Wikimedia MediaWiki Foundation. A security vulnerability exists in MediaWiki Cargo version 3.6.X prior to 3.6.1, which stems from the presence of a SQL injection vulnerability...

PT-2024-32851 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - Cargo versions 3.6.X before 3.6.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially leading to...

a-bot (0.0.1), a-gpt (>=0.1.0, <=0.4.0) +24298 more potentially affected by unknown CVE via atty (>=0.1.2, <=0.2.14)

atty CARGO version =0.1.2, =0.1.0, =0.0.5, =0.2.0, =0.0.1, =0.0.2, =0.4.1, =0.9.0, =0.1.0, =0.2.1, =1.0.3, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0375...