actix-session-surrealdb (>=0.1.0, <=0.1.5), bb8-surrealdb (>=0.1.0, <=0.1.3) +2 more potentially affected by CVE-2024-58363 via surrealdb (1.0.0-beta.9)

surrealdb CARGO version 1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2024-58363 Source advisory: OSV:GHSA-GH9F-6XM2-C4J2...

RUSTSEC-2024-0442 Dump Undefined Memory by `JitDumpFile`

The unsound function dumpcodeloadrecord uses fromrawparts to directly convert the pointer addr and len into a slice without any validation and that memory block would be dumped. Thus, the 'safe' function dumpcodeloadrecord is actually 'unsafe' since it requires the caller to guarantee that the ad...

Dump Undefined Memory by `JitDumpFile`

The unsound function dumpcodeloadrecord uses fromrawparts to directly convert the pointer addr and len into a slice without any validation and that memory block would be dumped. Thus, the 'safe' function dumpcodeloadrecord is actually 'unsafe' since it requires the caller to guarantee that the ad...

RUSTSEC-2024-0389 `openslide` is unmaintained

The openslide crate is no longer maintained. Last release was on 2018-11-20. Possible alternatives Consider using an alternative, for instance: - openslide-rs - pamly...

`openslide` is unmaintained

The openslide crate is no longer maintained. Last release was on 2018-11-20. Possible alternatives Consider using an alternative, for instance: - openslide-rs - pamly...

`opentelemetry_api` has been merged into the `opentelemetry` crate

Last release was on 2023-07-30. opentelemetryapi has been moved into the opentelemetry crate. Please use the opentelemetry crate going forward...

RUSTSEC-2024-0387 `opentelemetry_api` has been merged into the `opentelemetry` crate

Last release was on 2023-07-30. opentelemetryapi has been moved into the opentelemetry crate. Please use the opentelemetry crate going forward...

PT-2024-40935 · Unknown · Openslides

Name of the Vulnerable Software and Affected Versions: openslide affected versions not specified Description: The openslide crate is no longer maintained, with its last release on 2018-11-20. Recommendations: At the moment, there is no information about a newer version that contains a fix for thi...

PT-2024-40933 · Unknown · Opentelemetry Api

Name of the Vulnerable Software and Affected Versions: opentelemetry api affected versions not specified Description: The opentelemetry api has been moved into the opentelemetry crate. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

CBL Mariner 2.0 Security Update: cert-manager / cf-cli / docker-buildx / erlang / kubernetes / kubevirt (CVE-2023-48795)

The version of cert-manager / cf-cli / docker-buildx / erlang / kubernetes / kubevirt installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-48795 advisory. - The SSH transport protocol with certain...

async-mongodb-session (2.1.0), chord-action (>=0.1.13, <=0.1.16) +7 more potentially affected by CVE-2024-6382 via mongodb (>=2.0.0-alpha, <=2.6.1)

mongodb CARGO version =2.0.0-alpha, =0.1.13, =0.1.13, =0.1.13, =0.2.1, =0.3.2 - mongodb-gridfs 0.2.0 - rocketauthifier 0.111.0 - sqlite2mongo 0.3.0 Source cves: CVE-2024-6382 Source advisory: OSV:GHSA-32JF-H775-G29H...

Regular expression denial of service in Rust's regex crate

...

btctax-store (>=0.1.0, <=0.17.0), csaf-walker (0.1.0) +19 more potentially affected by CVE-2024-58261 via sequoia-openpgp (>=1.14.0, <=1.17.0)

sequoia-openpgp CARGO version =1.14.0, =0.1.0, =0.3.0, =0.25.0, =0.1.0, =0.30.0, =0.1.0, =0.1.0, =0.1.0, =0.6.0 - sequoia-keystore-tpm 0.1.0 and more Source cves: CVE-2024-58261 Source advisory: OSV:GHSA-9344-P847-QM5C...

RUSTSEC-2024-0388 `derivative` is unmaintained; consider using an alternative

The derivative crate is no longer maintained. Consider using any alternative, for instance: - derivemore - derive-where - educe...

`derivative` is unmaintained; consider using an alternative

The derivative crate is no longer maintained. Consider using any alternative, for instance: - derivemore - derive-where - educe...

adnl (1.0.0), aucpace (0.1.0) +23 more potentially affected by CVE-2024-58262 via curve25519-dalek (>=4.0.0-pre.1, <=4.1.0)

curve25519-dalek CARGO version =4.0.0-pre.1, =0.5.3, =0.5.0, =0.9.0-rc.0, =1.4.6, =2.0.0-pre.0, =0.1.0, =0.1.0, =0.1.0, =0.3.7, =2.0.0-pre.2, =3.0.0-pre.1 - opaquebind 0.3.6 and more Source cves: CVE-2024-58262 Source advisory: OSV:RUSTSEC-2024-0344...

RUSTSEC-2024-0394 mmap unmaintained

The mmap crate is unmaintained as its repository has been archived on Feb 10, 2022. The main alternative seems to be memmap2 crate...

mmap unmaintained

The mmap crate is unmaintained as its repository has been archived on Feb 10, 2022. The main alternative seems to be memmap2 crate...

Unable to generate the correct character set

Reduced entropy due to inadequate character set usage Description Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the nanoid::base62 and nanoid::base58 functions. Specifically, the base62 function used a character set of 32 symbols instead of the...

GHSA-9HC7-6W9R-WJ94 Unable to generate the correct character set

Reduced entropy due to inadequate character set usage Description Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the nanoid::base62 and nanoid::base58 functions. Specifically, the base62 function used a character set of 32 symbols instead of the...