Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
92 results · page 2 of 2
Mar 31, 2025WPCargo Track & Trace: Missing AuthorizationCVE-2025-31609 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
- Product
- WPCargo Track & Trace
- Affected
- up to 8.0.2
- What to do
- Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025WooCommerce Recargo de Equivalencia: Cross-Site Request Forgery (CSRF)CVE-2025-27342 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in josesan WooCommerce Recargo de Equivalencia woo-recargo-de-equivalencia allows Cross Site Request Forgery.This issue affects WooCommerce Recargo de Equivalencia: from n/a through <= 1.6.24.
- Product
- WooCommerce Recargo de Equivalencia
- Affected
- up to 1.6.24
- What to do
- Affects up to 1.6.24. Update WooCommerce Recargo de Equivalencia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WPCargo Track & Trace: Missing AuthorizationCVE-2024-54271 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
- Product
- WPCargo Track & Trace
- Affected
- up to 8.0.2
- What to do
- Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL InjeCVE-2024-47849 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccHigh 8.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
- Product
- Mediawiki - Cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Oct 4, 2024Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows CCVE-2024-47847 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccMedium 6.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
- Product
- Mediawiki - Cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orggerrit.wikimedia.org
Oct 4, 2024Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - CCVE-2024-47846 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccMedium 6.9
Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
- Product
- Mediawiki - Cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Sep 17, 2024Arni Cinco WPCargo Track & Trace wpcargo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-44004 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.
- Product
- Arni Cinco WPCargo Track & Trace wpcargo
- Fixed in
- 8.0.4
- What to do
- Update Arni Cinco WPCargo Track & Trace wpcargo to 8.0.4 or newer.
Sep 10, 2024Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0.CVE-2024-40754 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.9
Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2024Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0.CVE-2024-32671 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.9
Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of service via crafted inpCVE-2024-32672 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.3
A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of service via crafted input. This issue affects Escargot: 4.0.0.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024 Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers.CVE-2024-32669 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.3
Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the test code and does not include in the release. This issue affects escargot: 4.0.0.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.CVE-2023-29134 · Other software · mediawiki · reported by MITREHigh 8.6
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit.
- Product
- mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orggerrit.wikimedia.org
Jan 12, 2024An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2.CVE-2024-23173 · Other software · Mediawiki · reported by MITREMedium 6.1
An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Dec 5, 2023Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault.CVE-2023-41268 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.3
Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault. This issue affects Escargot: from 3.0.0 through 4.0.0.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023Cargo downloads a Rust project’s dependencies and compiles the project.CVE-2023-40030 · Other software · rust-lang · reported by GitHubMedium 6.1
Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to cross-site scripting if the report is subsequently uploaded somewhere. The vulnerability affects users relying on dependencies from git, local paths, or alternative registries. Users who solely depend on crates.io are unaffected. Rust 1.60.0 introduced `cargo build --timings`, which produces a report of how long the different steps of the build process took. It includes lists of Cargo features for each crate. Prior to Rust 1.72, Cargo feature names were allowed to contain almost any characters (with some exceptions as used by the feature syntax), but it would produce a future incompatibility warning about them since Rust 1.49. crates.io is far more stringent about what it considers a valid feature name and has not allowed such feature names. As the feature names were included unescaped in the timings report, they could be used to inject Javascript into
- Product
- cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023Cargo downloads the Rust project’s dependencies and compiles the project.CVE-2023-38497 · Other software · rust-lang · reported by GitHubHigh 7.9
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.
- Product
- cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
Jun 29, 2023An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.CVE-2023-37256 · Other software · Mediawiki · reported by MITREMedium 6.1
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.orgphabricator.wikimedia.org
Jun 29, 2023An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.CVE-2023-37254 · Other software · Mediawiki · reported by MITREMedium 6.1
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.orgphabricator.wikimedia.org
Jun 4, 2023IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking.CVE-2023-27285 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248625.
- Product
- Aspera Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 4, 2023IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized intCVE-2023-22862 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- Product
- Aspera Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
May 24, 2023Authorization Bypass Through User-Controlled Key vulnerability in Armoli Technology Cargo Tracking System allows Authentication Abuse, Authentication Bypass.CVE-2023-2065 · Computers, phones & browsers · Armoli Technology · reported by iletisim@usom.gov.trHigh 8.8
Authorization Bypass Through User-Controlled Key vulnerability in Armoli Technology Cargo Tracking System allows Authentication Abuse, Authentication Bypass. This issue affects Cargo Tracking System: before 3558f28 .
- Product
- Cargo Tracking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Apr 2, 2023IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking.CVE-2023-27286 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248616.
- Product
- Aspera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 2, 2023IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking.CVE-2023-27284 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248616.
- Product
- Aspera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 11, 2023Cargo is a Rust package manager.CVE-2022-46176 · Other software · rust-lang · reported by GitHubMedium 5.3
Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible.
- Product
- cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 14, 2022Cargo is a package manager for the rust programming language.CVE-2022-36114 · Other software · rust-lang · reported by GitHubMedium 4.8
Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that extracts way more data than its size (also known as a "zip bomb"), exhausting the disk space on the machine using Cargo to download the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it's possible to perform the same attacks with build scripts and procedural macros. The vulnerability is present in all versions of Cargo. Rust 1.64, to be released on September 22nd, will include a fix for it. Since the vulnerability is just a more limited way to accomplish what a malicious build scripts or procedural macros can do, we decided not to publish Rust point releases backporting the security fix. Patch files are available for Rust 1.63.0 are available in the wg-security-response reposit
- Product
- cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022Cargo is a package manager for the rust programming language.CVE-2022-36113 · Other software · rust-lang · reported by GitHubMedium 4.6
Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the root of the extracted source code once it extracted all the files. It was discovered that Cargo allowed packages to contain a .cargo-ok symbolic link, which Cargo would extract. Then, when Cargo attempted to write "ok" into .cargo-ok, it would actually replace the first two bytes of the file the symlink pointed to with ok. This would allow an attacker to corrupt one file on the machine using Cargo to extract the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it's possible to perform the same attacks with build scripts and procedural macros. The vulnerability is present in all versions of Cargo. Rust 1.64, to be released on
- Product
- cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022WPCargo Track & Trace: Does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the pageCVE-2022-1436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
May 16, 2022WPCargo Track & Trace: Does not sanitize and escapes some of its settingsCVE-2022-1435 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
May 13, 2022Air Cargo Management System v1.0 is vulnerable to file deletion via /acms/classes/Master.php?f=delete_img.CVE-2022-30367 · Other software · AIR Cargo Management System Project · reported by MITREMedium 6.5
Air Cargo Management System v1.0 is vulnerable to file deletion via /acms/classes/Master.php?f=delete_img.
- Product
- AIR Cargo Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/?page=transactions/manage_transaction&id=.CVE-2022-30374 · Other software · AIR Cargo Management System Project · reported by MITREHigh 7.2
Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/?page=transactions/manage_transaction&id=.
- Product
- AIR Cargo Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo_types/manage_cargo_type.php?id=.CVE-2022-30373 · Other software · AIR Cargo Management System Project · reported by MITREHigh 7.2
Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo_types/manage_cargo_type.php?id=.
- Product
- AIR Cargo Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete_cargo.CVE-2022-30372 · Other software · AIR Cargo Management System Project · reported by MITREHigh 7.2
Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete_cargo.
- Product
- AIR Cargo Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo_types/view_cargo_type.php?id=.CVE-2022-30371 · Other software · AIR Cargo Management System Project · reported by MITREHigh 7.2
Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo_types/view_cargo_type.php?id=.
- Product
- AIR Cargo Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete_cargo_type.CVE-2022-30370 · Other software · AIR Cargo Management System Project · reported by MITRECritical 9.8
Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete_cargo_type.
- Product
- AIR Cargo Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022WPCargo Track & Trace: Contains a fileCVE-2021-25003 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.0
- What to do
- Update WPCargo Track & Trace to 6.9.0 or newer.
Mar 2, 2022Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter.CVE-2022-26169 · Other software · AIR Cargo Management System Project · reported by MITRECritical 9.8
Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter.
- Product
- AIR Cargo Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup.CVE-2021-43388 · Other software · Unisys · reported by MITREHigh 7.5
Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag (in the manifest) is False.
- Product
- Cargo Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublic.support.unisys.compublic.support.unisys.com
Sep 30, 2019Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key.CVE-2019-16760 · Other software · rust · reported by GitHubMedium 4.6
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.
- Product
- cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgist.github.com
Aug 22, 2016SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10 allows remote attackers to execute arbitrary SQL commands via unspecifieCVE-2016-5817 · Other software · Navis · reported by ics-cert@hq.dhs.govCritical 9.8
SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Webaccess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Sep 16, 2013Cross-site scripting (XSS) vulnerability in ChamaNet ChamaCargo 7.0000 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecifieCVE-2013-4704 · Other software · Chamanet · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in ChamaNet ChamaCargo 7.0000 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Chamacargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2009PreProjects Pre Courier and Cargo Business stores dbcourior.mdb under the web root with insufficient access control, which allows remote attackers to obtain pasCVE-2008-6054 · Other software · Preprojects.com · reported by MITREMedium 5
PreProjects Pre Courier and Cargo Business stores dbcourior.mdb under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request.
- Product
- PRE Courier And Cargo Business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.linuxsecurity.comsecunia.com
Dec 4, 2006Cross-site scripting (XSS) vulnerability in Chama Cargo 4.36 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2006-6249 · Other software · Chama Cargo · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in Chama Cargo 4.36 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Chama Cargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.