12562 matches found
Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2...
CVE-2024-6382: Improper Handling of Syntactically Invalid Structure
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2...
RUSTSEC-2024-0346 Incorrect usage of `#[repr(packed)]`
The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...
RUSTSEC-2024-0347 Incorrect usage of `#[repr(packed)]`
The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...
ayaka-model (0.2.0), baked (1.0.0) +25 more potentially affected by unknown CVE via zerovec (>=0.2.3, <=0.8.1)
zerovec CARGO version =0.2.3, =0.3.0, =0.6.0, =0.5.0, =1.0.0-beta1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0347...
ayaka-model (0.2.0), baked (1.0.0) +15 more potentially affected by unknown CVE via zerovec-derive (>=0.6.0, <=0.8.0)
zerovec-derive CARGO version =0.6.0, =0.6.0, =1.0.0-beta1 - icuproviderblob 1.0.0-beta1 - icusegmenter 1.0.0-alpha1 - icusegmenterlstm 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0346...
Incorrect usage of `#[repr(packed)]`
The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...
Incorrect usage of `#[repr(packed)]`
The affected versions make unsafe memory accesses under the assumption that reprpacked has a guaranteed field order. The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 1.80.0-beta starts reordering fields of reprpacked structs, leading to illegal...
PT-2024-40912 · Softwarex +1 · Softwarex +1
Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 0.9.7 SoftwareX versions prior to 0.10.3 Description: The issue arises from unsafe memory accesses due to the assumption that reprpacked guarantees a specific field order in structs. However, the Rust specification...
PT-2024-40913 · Softwarex +1 · Softwarex +1
Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 0.9.7 SoftwareX versions prior to 0.10.4 Description: The issue arises from unsafe memory accesses due to the assumption that reprpacked guarantees a specific field order in structs. However, the Rust specification...
Regular expression denial of service in Rust's regex crate
...
An issue was discovered in the nalgebra crate before 0.27.1 for Rust. It allows out-of-bounds memory access because it does not ensure that the number of elements is equal to the product of the row count and column count.
...
Rust-Based P2PInfect Botnet Evolves with Miner and Ransomware Payloads
The peer-to-peer malware botnet known as P2PInfect has been found targeting misconfigured Redis servers with ransomware and cryptocurrency miners. The development marks the threat's transition from what appeared to be a dormant botnet with unclear motives to a financially motivated operation. "Wi...
btctax-store (>=0.1.0, <=0.18.0), pep_engine_sequoia_backend (1.1.0) +7 more potentially affected by CVE-2024-58261 via sequoia-openpgp (>=1.14.0, <=1.17.0)
sequoia-openpgp CARGO version =1.14.0, =0.1.0, =0.25.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0-rc.1, =4.1.1 Source cves: CVE-2024-58261 Source advisory: OSV:GHSA-9344-P847-QM5C...
a2d (>=0.1.0, <=0.1.11), abstract-adapter-utils (>=0.16.0, <=0.19.2) +2457 more potentially affected by unknown CVE via derivative (>=1.0.4, <=2.2.0)
derivative CARGO version =1.0.4, =0.1.0, =0.16.0, =0.1.0-rc.2, =0.0.1, =0.1.0-rc.2, =0.2.0-beta.4, =0.2.0-beta.4, =0.0.1, =0.0.1, =0.0.1, =0.1.0-rc.1, =0.0.1, =0.14.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0388...
btctax-store (>=0.1.0, <=0.18.0), pep_engine_sequoia_backend (1.1.0) +7 more potentially affected by CVE-2024-58261 via sequoia-openpgp (>=1.14.0, <=1.17.0)
sequoia-openpgp CARGO version =1.14.0, =0.1.0, =0.25.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0-rc.1, =4.1.1 Source cves: CVE-2024-58261 Source advisory: OSV:RUSTSEC-2024-0345...
atuin (>=0.3.0, <=0.4.0), bibliographix (>=0.1.0, <=0.6.0) +19 more potentially affected by unknown CVE via chrono-english (0.1.8)
chrono-english CARGO version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on chrono-english and may be impacted: - atuin =0.3.0, =0.1.0, =1.9.0, =0.2.0, =0.1.0, =0.4.2, =0.4.0, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.12.2 and more Source cves...
CVE-2022-1201 affecting package rust for versions less than 1.75.0-1
CVE-2022-1201 affecting package rust for versions less than 1.75.0-1. A patched version of the package is available...