CVE-2024-47614

The CVE-2024-47614 issue affects the Rust GraphQL server library async-graphql prior to version 7.0.10 . The vulnerability arises because it does not limit the number of directives for a field, which can lead to Service Disruption , Resource Exhaustion , and degraded User Experience . Affected so...

CVE-2024-47614 async-graphql vulnerable to Directive Overload

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10...

typedb-protocol (>=3.0.0-alpha-2, <=3.0.0-alpha-7) potentially affected by CVE-2024-47609 via tonic (0.12.2)

tonic CARGO version 0.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tonic and may be impacted: - typedb-protocol =3.0.0-alpha-2, =3.0.0-alpha-7 Source cves: CVE-2024-47609 Source advisory: OSV:GHSA-4JWC-W2HC-78QV...

typedb-protocol (>=3.0.0-alpha-2, <=3.0.0-alpha-7) potentially affected by CVE-2024-47609 via tonic (0.12.2)

tonic CARGO version 0.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tonic and may be impacted: - typedb-protocol =3.0.0-alpha-2, =3.0.0-alpha-7 Source cves: CVE-2024-47609 Source advisory: OSV:RUSTSEC-2024-0376...

THN Cybersecurity Recap: Last Week's Top Threats and Trends (September 23-29)

Hold onto your hats, folks, because the cybersecurity world is anything but quiet! Last week, we dodged a bullet when we discovered vulnerabilities in CUPS that could've opened the door to remote attacks. Google's switch to Rust is paying off big time, slashing memory-related vulnerabilities in...

Google's Shift to Rust Programming Cuts Android Memory Vulnerabilities by 68%

Google has revealed that its transition to memory-safe languages such as Rust as part of its secure-by-design approach has led to the percentage of memory-safe vulnerabilities discovered in Android dropping from 76% to 24% over a period of six years. The tech giant said focusing on Safe Coding fo...

Cybersecurity Researchers Warn of New Rust-Based Splinter Post-Exploitation Tool

Cybersecurity researchers have flagged the discovery of a new post-exploitation red team tool called Splinter in the wild. Palo Alto Networks Unit 42 shared its findings after it discovered the program on several customers' systems. "It has a standard set of features commonly found in penetration...

`atty` is unmaintained

The maintainer of atty has published an official notice that the crate is no longer under development, and that users should instead rely on the functionality in the standard library's IsTerminal trait. Alternatives - std::io::IsTerminal - Stable since Rust 1.70.0 and the recommended replacement...

RUSTSEC-2024-0375 `atty` is unmaintained

The maintainer of atty has published an official notice that the crate is no longer under development, and that users should instead rely on the functionality in the standard library's IsTerminal trait. Alternatives - std::io::IsTerminal - Stable since Rust 1.70.0 and the recommended replacement...

a-bot (0.0.1), a-gpt (>=0.1.0, <=0.4.0) +24321 more potentially affected by unknown CVE via atty (>=0.1.2, <=0.2.14)

atty CARGO version =0.1.2, =0.1.0, =0.0.5, =0.2.0, =0.0.1, =0.0.2, =0.4.1, =0.9.0, =0.1.0, =0.2.1, =1.0.3, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0375...

PT-2024-40922 · Atty +1 · Atty +1

Name of the Vulnerable Software and Affected Versions: atty affected versions not specified Description: The maintainer of atty has announced that the crate is no longer under development. Users are recommended to rely on the functionality in the standard library's IsTerminal trait instead...

GLSA-202409-07 : Rust: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202409-07 Rust: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Rust. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from th...

Rust: Multiple Vulnerabilities

Background A systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. Description Multiple vulnerabilities have been discovered in Rust. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE...

lexical-core has multiple soundness issues

RUSTSEC-2024-0377 contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls...

GHSA-2326-PFPJ-VX3H lexical-core has multiple soundness issues

RUSTSEC-2024-0377 contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls...

Internet Bug Bounty: `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods

The Rust Security Response WG disclosed a vulnerability in the std::process::Command module on Windows, where it incorrectly escaped arguments when invoking batch files. This allowed for bypassing the fix by including trailing whitespace or periods in the batch file name, which are ignored and...

MAL-2024-8875 Malicious code in rust-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 879e91954c530c7fda9e73575ef2f4a945be9a29a5761866d4a4470b32469ce1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rust-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 879e91954c530c7fda9e73575ef2f4a945be9a29a5761866d4a4470b32469ce1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

afarray (>=0.1.0, <=0.15.1), b-table (>=0.1.0, <=0.2.1) +39 more potentially affected by unknown CVE via get-size-derive (>=0.1.2, <=0.1.3)

get-size-derive CARGO version =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.1.0, =0.8.0, =0.1.0, =0.1.0, =0.3.1, =0.9.1, =0.0.6, =0.1.0, =0.8.0, =0.9.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0427...

afarray (>=0.1.0, <=0.15.1), b-table (>=0.1.0, <=0.2.1) +43 more potentially affected by unknown CVE via get-size (>=0.1.3, <=0.1.4)

get-size CARGO version =0.1.3, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.1.0, =0.8.0, =0.1.0, =0.3.1, =0.3.3, =0.1.0, =0.9.1, =0.14.0 - pathlink 0.1.0 - poseidon-bn128 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0425...