OESA-2025-1120 three-eight-nine-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions ssl::selectnextproto can return a slice pointing into th...

RUSTSEC-2025-0028 cve-rs introduces memory vulnerabilities in safe Rust

This crate is a joke and should never be used. cve-rs provides demonstrations of common memory vulnerabilities such as buffer overflows and segfaults implemented completely within safe Rust. Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc:...

totally-safe-transmute allows transmuting any type to any other type in safe Rust

This crate is a toy and should never be used. It showcases a known soundness issue https://github.com/rust-lang/rust/issues/32670 that will never get fixed. In short, Linux provides a file called /proc/self/mem which can be used by a program to modify its own memory. This library modifies an enum...

cve-rs introduces memory vulnerabilities in safe Rust

This crate is a joke and should never be used. cve-rs provides demonstrations of common memory vulnerabilities such as buffer overflows and segfaults implemented completely within safe Rust. Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc:...

PT-2025-19819 · Crates.Io · Totally-Safe-Transmute

This crate is a toy and should never be used. It showcases a known soundness issue https://github.com/rust-lang/rust/issues/32670 that will never get fixed. In short, Linux provides a file called /proc/self/mem which can be used by a program to modify its own memory. This library modifies an enum...

Fedora 41 : clevis-pin-tpm2 / dbus-parsec / envision / fido-device-onboard / etc (2025-f8be7978e3)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-f8be7978e3 advisory. Update the openssl crate to version 0.10.70 and the openssl-sys crate to version 0.9.105. This includes a fix for RUSTSEC-2025-0004 / CVE-2025-0977 and...

CVE-2024-36400

nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the nanoid::base62 and nanoid::base58 functions. Specifically, the base62 function used a character set of 32 symbols instead of the intended 62...

acme-client (>=0.1.0, <=0.2.0), aerial (0.1.0) +870 more potentially affected by CVE-2025-24898 via openssl (>=0.2.18, <=0.10.68)

openssl CARGO version =0.2.18, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.7.0, =0.1.0, =0.0.10, =0.0.1, =0.1.0, =0.2.0 - apns 0.1.1 - aries 0.1.0 - arubaripple 0.0.1 and more Source cves: CVE-2025-24898 Source advisory: OSV:RUSTSEC-2025-0004...

RUSTSEC-2025-0160 `custom-req-on-workers` was removed from crates.io for malicious code

custom-req-on-workers was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in January 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

`custom-req-on-workers` was removed from crates.io for malicious code

custom-req-on-workers was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in January 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

`jfrog_quotes` was removed from crates.io for malicious code

jfrogquotes was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in January 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

GHSA-WWX5-GPGR-VXR7 ismp-grandpa crate accepted incorrect signatures

A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. Description The vulnerability manifests as a verifer that only accepts incorrect signatures of Grandpa precommits and was introduce...

CVE-2025-24800

The CVE-2025-24800 vulnerability affects the ismp-grandpa crate used by Hyperbridge. A flaw in Grandpa signature verification could cause a malicious prover to convince the verifier of the finality of arbitrary headers, potentially enabling fund theft or compromise of cross-chain applications. Th...

PT-2025-5577

Name of the Vulnerable Software and Affected Versions Hyperbridge versions prior to 15.0.1 Description A critical issue was discovered in the ismp-grandpa crate, allowing a malicious prover to easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or...

CVE-2024-12957

A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information...

CVE-2024-12957

A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information...

CVE-2024-12957

A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information...

CVE-2024-12957

CVE-2024-12957 is a file handling command vulnerability in Armoury Crate that may result in arbitrary file deletion. Affected products are Armoury Crate versions as referenced by ASUS/Red Hat advisories; the underlying issue is a faulty file handling command leading to deletion of files. The avai...

ASUS Armoury Crate Service 访问控制错误漏洞

ASUS Armoury Crate Service is a software utility program from Asus China. It is designed to provide centralized control over supported ROG gaming products. An access control error vulnerability exists in ASUS Armoury Crate Service. An attacker can exploit this vulnerability to delete arbitrary...

PT-2025-1981 · Asus · Armoury Crate

The Armoury Crate App is affected by a file handling command issue that can lead to arbitrary file deletion. The affected software is Armoury Crate, and an exploit for this issue is available. Unfortunately, the specific versions of Armoury Crate that are affected are not specified. More...