297 matches found
RUSTSEC-2025-0039 Lack of sufficient checks in public API
The following functions in the anon-vec crate are unsound due to insufficient checks on their arguments:: - AnonVec::getref - AnonVec::getmut - AnonVec::removeget The crate was built as a learning project and is not being maintained...
Lack of sufficient checks in public API
The following functions in the anon-vec crate are unsound due to insufficient checks on their arguments:: - AnonVec::getref - AnonVec::getmut - AnonVec::removeget The crate was built as a learning project and is not being maintained...
PT-2025-20009 · Crates.Io · Tanton Engine
The following functions in the tanton engine crate are unsound due to lack of sufficient boundary checks in public API: - Stack::offset - ThreadStack::get - RootMoveList::insert score depth - RootMoveList::insert score The tanton engine crate is no longer maintained, so there are no plans to...
[SECURITY] Fedora 40 Update: augeas-1.14.2-0.4.20250324git4dffa3d.fc40
A library for programmatically editing configuration files. Augeas parses configuration files into a tree structure, which it exposes through its public API. Changes made through the API are written back to the initially read files. The transformation works very hard to preserve comments and...
RUSTSEC-2025-0033 Public API without sufficient bounds checking
Match::get and Match::ptr lack sufficient bounds checks, leading to potential out of bounds reads...
CVE-2024-9099
In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to...
CVE-2024-12108
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API...
SUSE-SU-2025:20094-1 Security update for python-requests
This update for python-requests contains the following fixes: - Add patch to fix to inject the default CA bundles if they are not specified. bsc1226321, bsc1231500 - Remove Requires on python-py, it should have been removed earlier. - update to 2.32.3: Fixed bug breaking the ability to specify...
CVE-2024-12108
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API...
CVE-2024-12108
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API...
CVE-2024-12108 WhatsUp Gold - Public API signing key rotation issue
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API...
CVE-2024-12108
CVE-2024-12108 affects Progress WhatsUp Gold versions before 2024.0.2. The available connected sources indicate that an attacker can gain unauthorized access to the WhatsUp Gold server through the public API. The impact is described as high/critical in CVSS terms (network access, low attack compl...
Unsound usages of `u8` type casting in spl-token-swap
The library provides a safe public API unpack to cast u8 array to arbitrary types, which can cause to undefined behaviors. The length check of array can only prevent out-of-bound access on the return type. However, it can't prevent misaligned pointer when casting u8 pointer to a type aligned to...
RUSTSEC-2024-0426 Unsound usages of `u8` type casting
The library provides a safe public API unpack to cast u8 array to arbitrary types, which can cause to undefined behaviors. The length check of array can only prevent out-of-bound access on the return type. However, it can't prevent misaligned pointer when casting u8 pointer to a type aligned to...
Malicious code in public-api-signature-calculator-example (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-11428 Malicious code in public-api-signature-calculator-example (npm)
--- -= Per source details. Do not edit below this line.=-...
OPENSUSE-SU-2024:0382-1 Security update for cobbler
This update for cobbler fixes the following issues: Update to 3.3.7: Security: Fix issue that allowed anyone to connect to the API as admin CVE-2024-47533, boo1231332 bind - Fix bug that prevents cname entries from being generated successfully Fix build on RHEL9 based distributions fence-agents-a...
CVE-2023-32193
A vulnerability has been identified in which unauthenticated cross-site scripting XSS in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely...
CVE-2023-32193
A vulnerability has been identified in which unauthenticated cross-site scripting XSS in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely...