CVE-2023-37254

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format...

MediaWiki 跨站脚本漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.39.3, which stems from an issue found in...

CVE-2023-37254

CVE-2023-37254 affects the Cargo extension for MediaWiki up to 1.39.3. It enables cross-site scripting via Special:CargoQuery via a crafted page item when using the default format. The CVSS metrics indicate network access with user interaction required and no privileges, with impact on confidenti...

CVE-2023-37254

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format...

CVE-2023-37256

CVE-2023-37256 affects the MediaWiki Cargo extension up to 1.39.3, which permits storing javascript: URLs in URL fields and automatically linking them. Public details in connected advisories indicate remediation via upgrading MediaWiki to 1.39.5 or later (and 1.40.x to 1.40.1 or later). Exploitat...

PT-2023-25859 · Mediawiki +1 · Mediawiki Cargo Extension +1

Name of the Vulnerable Software and Affected Versions: MediaWiki Cargo extension versions through 1.39.3 Description: An issue was discovered in the Cargo extension for MediaWiki that allows storing javascript: URLs in URL fields, and these URLs are automatically linked. Recommendations: For...

PT-2023-25857 · Mediawiki +1 · Mediawiki Cargo Extension +1

Name of the Vulnerable Software and Affected Versions: MediaWiki Cargo extension versions through 1.39.3 Description: An issue in the Cargo extension for MediaWiki allows XSS to occur in Special:CargoQuery via a crafted page item when using the default format. The estimated number of potentially...

MediaWiki 跨站脚本漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.39.3, which stems from a cross-site...

CVE-2023-37256

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs...

CVE-2023-37256

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +4044 more potentially affected by unknown CVE via memoffset (>=0.1.0, <=0.5.6)

memoffset CARGO version =0.1.0, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.7.10 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WFG4-322G-9VQV...

ink (4.0.0-alpha.3) potentially affected by CVE-2023-34449 via ink_env (4.0.0-alpha.3)

inkenv CARGO version 4.0.0-alpha.3 is affected by a known vulnerability. The following packages have a transitive dependency on inkenv and may be impacted: - ink 4.0.0-alpha.3 Source cves: CVE-2023-34449 Source advisory: OSV:GHSA-853P-5678-HV8F...

cranko (>=0.0.21, <=0.16.0), diener (>=0.1.0, <=0.4.2) +9 more potentially affected by CVE-2023-33290 via git-url-parse (>=0.2.0, <=0.3.1)

git-url-parse CARGO version =0.2.0, =0.0.21, =0.1.0, =0.0.1, =0.0.1, =2.3.0, =0.1.0, =0.3.1, =0.1.1, =0.1.0, =0.2.1 Source cves: CVE-2023-33290 Source advisory: OSV:GHSA-QFH9-8P57-MJJJ...

abel (>=0.1.0, <=0.1.1), abel-core (>=0.1.0, <=0.1.1) +331 more potentially affected by unknown CVE via ouroboros (>=0.5.1, <=0.15.6)

ouroboros CARGO version =0.5.1, =0.1.0, =0.1.0, =0.2.0, =0.4.0, =0.2.0, =0.4.0, =0.6.0, =0.1.0, =1.1.0, =0.6.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0042...

IBM Aspera Connect and IBM Aspera Cargo Buffer Overflow Vulnerability

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. A buffer overflow vulnerability exists in IBM Aspera Connect and IBM Aspera Cargo, which originates from a boundary check error and can be exploited by an...

CVE-2023-22862

IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...

CVE-2023-22862

IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...

CVE-2023-27285

IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248625...

CVE-2023-27285

IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248625...

Authentication flaw

IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. IBM X-Force ID: 244107...