CVE-2020-35917

An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From...

CVE-2020-35917

An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From...

PT-2020-17582

Name of the Vulnerable Software and Affected Versions autorand crate versions prior to 0.2.3 Description An issue in the autorand crate for Rust can lead to memory corruption due to the dropping of uninitialized memory when a panic occurs. This happens because of the implementation of Random on...

PT-2020-17593

Name of the Vulnerable Software and Affected Versions va-ts crate versions prior to 0.0.4 Description The issue arises from the Demuxer implementation in the va-ts crate, which lacks a required T: Send bound. This omission allows sending a non-Send type T across thread boundaries, potentially...

SyncRef's clone() and debug() allow data races

Affected versions of this crate unconditionally implement Sync for SyncRef. This definition allows data races if &T is accessible through &SyncRef. SyncRef derives Clone and Debug, and the default implementations of those traits access &T by invoking T::clone & T::fmt. It is possible to create da...

RUSTSEC-2020-0127 SyncRef's clone() and debug() allow data races

Affected versions of this crate unconditionally implement Sync for SyncRef. This definition allows data races if &T is accessible through &SyncRef. SyncRef derives Clone and Debug, and the default implementations of those traits access &T by invoking T::clone & T::fmt. It is possible to create da...

Send bound needed on T (for Send impl of `Bucket2`)

Affected versions of this crate unconditionally implements Send for Bucket2. This allows sending non-Send types to other threads. This can lead to data races when non Send types like Cell or Rc are contained inside Bucket2 and sent across thread boundaries. The data races can potentially lead to...

RUSTSEC-2020-0074 Reference counting error in `From<Py<T>>`

A bug in From would lead to an extra reference count decrement, often leading to use-after-free issues...

Reference counting error in `From<Py<T>>`

A bug in From would lead to an extra reference count decrement, often leading to use-after-free issues...

WS-2020-0205

A vulnerability was found in PyO3 before version 0.12.4. A bug in From would lead to an extra reference count decrement, often leading to use-after-free issues. This issue affects only versions 0.12.0 through 0.12.3...

PT-2020-17549

Name of the Vulnerable Software and Affected Versions pyo3 crate versions prior to 0.12.4 Description An issue in the pyo3 crate leads to a reference-counting error and use-after-free in From. This is caused by a bug that results in an extra reference count decrement, often leading to...

PT-2020-17628

Name of the Vulnerable Software and Affected Versions cache crate through 2020-11-24 Description An issue in the cache crate allows users to insert types that are not Send or not Sync, such as Arc or Rc, as K in Cache. This can lead to data races, which can result in memory corruption...

CVE-2020-12496

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 and Memograph M Neutral/Private Label RSG45, ORSG45 with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to t...

CVE-2020-12496

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 and Memograph M Neutral/Private Label RSG45, ORSG45 with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to t...

CVE-2020-12495

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. T...

CVE-2020-12495

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. T...

Code injection

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 and Memograph M Neutral/Private Label RSG45, ORSG45 with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to t...

CVE-2020-12496 ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 2.x exposures sensitive information to an unauthorized actor

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 and Memograph M Neutral/Private Label RSG45, ORSG45 with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to t...

CVE-2020-12496

The CVE-2020-12496 entry concerns Endress+Hauser Ecograph T and Memograph M devices (Firmware v2.0.0 and above). A server-side access-control matrix misconfiguration allows a low-privilege user to access endpoints that should be restricted, leading to exposure of sensitive information. The firmwa...

CVE-2020-12495 ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 1.x has improper privilege management

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. T...