CVE-2020-36455

An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock unconditionally implements Send and Sync...

CVE-2020-36434

An issue was discovered in the sys-info crate before 0.8.0 for Rust. sysinfo::diskinfo calls can trigger a double free...

CVE-2021-38196

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose...

UBUNTU-CVE-2020-36465

An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes...

CVE-2020-36471

An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function for yielding values has Send bounds...

CVE-2021-38190

An issue was discovered in the nalgebra crate before 0.27.1 for Rust. It allows out-of-bounds memory access because it does not ensure that the number of elements is equal to the product of the row count and column count...

CVE-2020-36470

An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references...

a2 (0.3.6), aerospike (0.3.0) +193 more potentially affected by CVE-2021-32810 via crossbeam-deque (>=0.1.1, <=0.6.3)

crossbeam-deque CARGO version =0.1.1, =0.2.5, =0.11.0, =0.2.0, =0.6.0, =0.5.0, =0.4.0, =0.5.0, =0.6.0, =0.3.0, =0.6.0, =0.7.0, =0.3.0, =0.6.0 and more Source cves: CVE-2021-32810 Source advisory: OSV:RUSTSEC-2021-0093...

ckb-analyzer (0.39.2), ckb-app-config (>=0.37.0-pre, <=0.100.0-rc2) +57 more potentially affected by CVE-2021-45697 via molecule (>=0.2.5, <=0.7.1)

molecule CARGO version =0.2.5, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.40.0, =0.40.0, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.1.0, =0.37.0-pre, =0.39.1 and more Source cves: CVE-2021-45697 Source advisory: OSV:RUSTSEC-2021-0103...

ark-bls12-377 (0.2.0), ark-crypto-primitives (0.2.0) +19 more potentially affected by CVE-2021-38194 via ark-r1cs-std (0.2.0)

ark-r1cs-std CARGO version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ark-r1cs-std and may be impacted: - ark-bls12-377 0.2.0 - ark-crypto-primitives 0.2.0 - ark-curve-constraint-tests 0.2.0 - ark-ed-on-bls12-377 0.2.0 - ark-ed-on-bls12-381...

requeuest (>=0.1.1, <=0.2.1), sqlxmq (>=0.2.0, <=0.2.1) potentially affected by CVE-2021-38191 via tokio (1.8.0)

tokio CARGO version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - requeuest =0.1.1, =0.2.0, =0.2.1 Source cves: CVE-2021-38191 Source advisory: OSV:RUSTSEC-2021-0072...

clarity-repl (>=0.12.3, <=0.13.3) potentially affected by CVE-2021-38191 via tokio (1.6.1)

tokio CARGO version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - clarity-repl =0.12.3, =0.13.3 Source cves: CVE-2021-38191 Source advisory: OSV:RUSTSEC-2021-0072...

abc-ecs (>=0.1.0, <=0.2.1), abc_game_engine (>=0.1.0, <=0.1.2) +308 more potentially affected by CVE-2021-38187 via anymap (>=0.10.3, <=1.0.0-beta.2)

anymap CARGO version =0.10.3, =0.1.0, =0.1.0, =1.0.0-alpha.1, =0.1.6, =0.1.0-alpha.2, =0.8.0, =0.1.0, =5.0.0, =5.2.2, =0.0.1-alpha+3, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.2 and more Source cves: CVE-2021-38187 Source advisory: OSV:RUSTSEC-2021-0065...

CVE-2021-29942

An issue was discovered in the reorder crate through 2021-02-24 for Rust. swapindex can return uninitialized values if an iterator returns a len that is too large...

CVE-2021-29932

An issue was discovered in the parseduration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service CPU and memory consumption via a duration string with a large exponent...

CVE-2021-29929

The CVE-2021-29929 entry concerns the endian_trait crate for Rust (through 2021-01-04). The root cause is a panic in a user-provided Endian implementation, which can trigger a double drop of the underlying value. This is described across multiple sources (e.g., RUSTSEC-2021-0039 and related advis...

booklibrs (>=0.1.0, <=1.0.4), fl2rust (0.3.1) +5 more potentially affected by CVE-2021-28306 +2 more via fltk (>=0.9.7, <=0.14.13)

fltk CARGO version =0.9.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =0.9.15 Source cves: CVE-2021-28306, CVE-2021-28307, CVE-2021-28308 Source advisory: OSV:RUSTSEC-2021-0038...

CVE-2021-28029

An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations...

CVE-2021-28035

An issue was discovered in the stackdst crate before 0.6.1 for Rust. Because of the pushinner behavior, a drop of uninitialized memory can occur upon a val.clone panic...

CVE-2021-28027

An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block...