audir (0.1.0), com-impl (>=0.1.0, <=0.1.1) +6 more potentially affected by CVE-2021-45681 via derive-com-impl (0.1.1)

derive-com-impl CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on derive-com-impl and may be impacted: - audir 0.1.0 - com-impl =0.1.0, =0.3.0-alpha1, =0.3.0-alpha1, =0.3.0-alpha4 - dxgi 0.3.0-alpha4 - wic 0.3.0-alpha1 Source cves:...

aes-keywrap-rs (>=0.1.0, <=0.2.0), shadowsocks-crypto (>=0.1.0, <=0.2.5) potentially affected by CVE-2021-45709 via crypto2 (0.1.2)

crypto2 CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on crypto2 and may be impacted: - aes-keywrap-rs =0.1.0, =0.1.0, =0.2.5 Source cves: CVE-2021-45709 Source advisory: OSV:GHSA-PMCV-MGCF-RVXG...

amethyst-console (0.1.0), amethyst-imgui (>=0.5.0, <=0.6.0) +50 more potentially affected by unknown CVE via crossbeam-queue (>=0.1.2, <=0.2.0)

crossbeam-queue CARGO version =0.1.2, =0.5.0, =0.1.0, =0.7.0, =0.8.0, =0.7.0, =0.6.0, =0.8.0, =0.7.0, =0.9.0, =0.6.0, =0.6.0, =0.0.1, =0.0.1, =0.2.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-6888-WF7J-34JQ...

abi_stable (>=0.4.0, <=0.8.4), aeron-rs (>=0.1.2, <=0.1.3) +388 more potentially affected by unknown CVE via crossbeam-channel (>=0.1.3, <=0.3.9)

crossbeam-channel CARGO version =0.1.3, =0.4.0, =0.1.2, =0.7.5, =0.2.5, =0.4.0, =0.5.0, =0.1.0, =0.6.0, =0.5.0, =0.4.0, =0.5.0, =0.6.0 - amethystderive 0.3.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9G55-PG62-M8HH...

GHSA-72R2-RG28-47V9 `read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)

Affected versions of this crate calls a user provided Read implementation on an uninitialized buffer. Read on uninitialized buffer is defined as undefined behavior in Rust...

`read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)

Affected versions of this crate calls a user provided Read implementation on an uninitialized buffer. Read on uninitialized buffer is defined as undefined behavior in Rust...

binjs_es6 (0.2.1) potentially affected by CVE-2021-45683 via binjs_io (0.2.1)

binjsio CARGO version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on binjsio and may be impacted: - binjses6 0.2.1 Source cves: CVE-2021-45683 Source advisory: OSV:GHSA-C6PX-4GRW-HRJR...

a2d (>=0.1.0, <=0.1.11), acidalia (>=0.1.0, <=0.1.3) +239 more potentially affected by CVE-2021-45688 via ash (>=0.24.4, <=0.32.1)

ash CARGO version =0.24.4, =0.1.0, =0.1.0, =0.0.1, =0.1.2, =0.1.0, =0.5.4-rc.1, =0.1.0, =0.1.0, =0.2.0, =0.17.0 and more Source cves: CVE-2021-45688 Source advisory: OSV:GHSA-QJ69-C89V-JWQ2...

`array!` macro is unsound in presence of traits that implement methods it calls internally

Affected versions of this crate called some methods using auto-ref. The affected code looked like this. rust let mut arr = $crate::core::mem::MaybeUninit::uninit; let mut vec = $crate::ArrayVec::::newarr.asmutptr as mut T; In this case, the problem is that asmutptr is a method of &mut MaybeUninit...

GHSA-HFXP-P695-629X abomonation transmutes &T to and from &[u8] without sufficient constraints

This transmute is at the core of the abomonation crates. It's so easy to use it to violate alignment requirements that no test in the crate's test suite passes under miri. The use of this transmute in serialization/deserialization also incorrectly assumes that the layout of a reprRust type is...

abomonation_derive (>=0.1.0, <=0.5.0), abomonation_derive_ng (0.1.0) +24 more potentially affected by CVE-2021-45708 via abomonation (>=0.4.6, <=0.7.3)

abomonation CARGO version =0.4.6, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.1.0, =0.5.0, =0.8.0, =0.13.0, =0.30.1 and more Source cves: CVE-2021-45708 Source advisory: OSV:GHSA-HFXP-P695-629X...

abomonation transmutes &T to and from &[u8] without sufficient constraints

This transmute is at the core of the abomonation crates. It's so easy to use it to violate alignment requirements that no test in the crate's test suite passes under miri. The use of this transmute in serialization/deserialization also incorrectly assumes that the layout of a reprRust type is...

a3mo_lib (>=0.1.0, <=0.1.1), aaa_csv_challenge (0.1.0) +3528 more potentially affected by CVE-2019-25010 +1 more via failure (>=0.1.0, <=0.1.8)

failure CARGO version =0.1.0, =0.1.0, =0.0.1, =0.1.0-pre.1, =0.5.0, =0.3.0, =0.3.0-alpha.1, =0.2.0, =0.3.1 - accurate 0.3.0 and more Source cves: CVE-2019-25010, CVE-2020-25575 Source advisory: OSV:GHSA-JQ66-XH47-J9F3...

Type confusion if __private_get_type_id__ is overriden

An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap...

CVE-2022-31053

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

Authentication flaw

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid G-signatures. Such an attack would allow an attacker to create a token with any access level. The...

The many lives of BlackCat ransomware

The BlackCat ransomware, also known as ALPHV, is a prevalent threat and a prime example of the growing ransomware-as-a-service RaaS gig economy. It’s noteworthy due to its unconventional programming language Rust, multiple target devices and possible entry points, and affiliation with prolific...

The many lives of BlackCat ransomware

The BlackCat ransomware, also known as ALPHV, is a prevalent threat and a prime example of the growing ransomware-as-a-service RaaS gig economy. It’s noteworthy due to its unconventional programming language Rust, multiple target devices and possible entry points, and affiliation with prolific...

abc (>=0.1.0, <=0.2.3), aerospike (>=0.0.1, <=1.3.0) +273 more potentially affected by unknown CVE via crossbeam (>=0.1.6, <=0.2.12)

crossbeam CARGO version =0.1.6, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.4.0, =0.1.0, =0.1.3, =0.11.0 - bmengine 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RWF4-GX62-RQFW...

abc (>=0.1.0, <=0.2.3), aerospike (>=0.0.1, <=1.3.0) +273 more potentially affected by unknown CVE via crossbeam (>=0.1.6, <=0.2.12)

crossbeam CARGO version =0.1.6, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.4.0, =0.1.0, =0.1.3, =0.11.0 - bmengine 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0029...