Overflow in libsecp256k1

An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow...

bellman-keccak256 (0.1.0), bitcoin-cash-ecc (>=0.1.1, <=1.0.0-beta.0) +154 more potentially affected by CVE-2021-38195 via libsecp256k1 (>=0.1.3, <=0.3.5)

libsecp256k1 CARGO version =0.1.3, =0.1.1, =0.1.0, =0.2.0, =0.3.0, =0.2.0, =0.1.0, =0.0.3, =0.0.12 and more Source cves: CVE-2021-38195 Source advisory: OSV:GHSA-G4VJ-X7V9-H82M...

Remote code execution in better-macro

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose...

GHSA-79WF-QCQV-R22R Remote code execution in better-macro

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose...

ark-bls12-377 (0.2.0), ark-crypto-primitives (0.2.0) +19 more potentially affected by CVE-2021-38194 via ark-r1cs-std (0.2.0)

ark-r1cs-std CARGO version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ark-r1cs-std and may be impacted: - ark-bls12-377 0.2.0 - ark-crypto-primitives 0.2.0 - ark-curve-constraint-tests 0.2.0 - ark-ed-on-bls12-377 0.2.0 - ark-ed-on-bls12-381...

GHSA-5325-XW5M-PHM3 Cross-site Scripting in ammonia

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870...

acacia (0.2.0), adaptive-bezier (0.1.0) +523 more potentially affected by CVE-2021-38190 via nalgebra (>=0.11.2, <=0.26.2)

nalgebra CARGO version =0.11.2, =0.1.0, =0.2.0, =0.1.0, =0.5.0, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =0.15.3 and more Source cves: CVE-2021-38190 Source advisory: OSV:GHSA-3W8G-XR3F-2MP8...

Incorrect buffer size calculation in iced-x86

An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new, slice.getuncheckedslice.length is used unsafely...

GHSA-HC92-9H3M-C39J Incorrect cast in anymap

An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a u8 to a u64...

abc-ecs (>=0.1.0, <=0.1.2), anyflux (0.1.0) +138 more potentially affected by CVE-2021-38187 via anymap (>=0.10.3, <=0.12.1)

anymap CARGO version =0.10.3, =0.1.0, =0.13.0, =3.0.0, =0.0.3, =0.1.0, =0.3.0, =0.5.0-beta.1, =0.0.5, =0.1.0, =0.15.1, =0.0.1, =0.0.1, =0.0.10 and more Source cves: CVE-2021-38187 Source advisory: OSV:GHSA-HC92-9H3M-C39J...

Incorrect cast in anymap

An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a u8 to a u64...

GHSA-6WJ2-G87R-PM62 Cross-site Scripting in comrak

An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via & HTML entities...

bloguen (>=0.1.0, <=0.1.1), cargo-docco (0.1.0) +27 more potentially affected by CVE-2021-38186 via comrak (>=0.1.9, <=0.9.1)

comrak CARGO version =0.1.9, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.0.1, =0.0.5, =1.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2021-38186 Source advisory: OSV:GHSA-6WJ2-G87R-PM62...

Cross-site Scripting in comrak

An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via & HTML entities...

evm (>=0.13.0, <=0.20.0), evm-gasometer (>=0.13.0, <=0.20.0) +2 more potentially affected by unknown CVE via evm-core (>=0.13.1, <=0.20.0)

evm-core CARGO version =0.13.1, =0.13.0, =0.13.0, =0.13.0, =2.0.0-alpha.3, =2.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-773Q-5334-5GF9...

Use-after-free in yottadb

An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydbsubscriptnextst and ydbsubscriptprevst have a use-after-free...

GHSA-9658-C26V-7QVF Use-after-free in yottadb

An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydbsubscriptnextst and ydbsubscriptprevst have a use-after-free...

blob (>=0.1.0, <=0.1.1), buzz (>=0.2.0, <=1.0.4) +50 more potentially affected by CVE-2017-1000430 via base64 (>=0.1.1, <=0.4.2)

base64 CARGO version =0.1.1, =0.1.0, =0.2.0, =0.1.4, =0.1.0, =0.5.1, =0.1.0, =0.1.9, =0.3.0, =0.2.0, =0.3.2, =0.1.0, =0.4.0, =0.1.0, =0.4.0 - lapin-futures 0.1.0 and more Source cves: CVE-2017-1000430 Source advisory: OSV:GHSA-X67X-VG9M-65C3...

Uninitialized memory access in outer_cgi

An issue was discovered in the outercgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader...

GHSA-6VMQ-JH76-HQ43 Uninitialized memory access in outer_cgi

An issue was discovered in the outercgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader...