3845 matches found
actix-session-surrealdb (>=0.1.0, <=0.1.5), bb8-surrealdb (>=0.1.0, <=0.1.3) +2 more potentially affected by CVE-2024-58364 via surrealdb (1.0.0-beta.9)
surrealdb CARGO version 1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2024-58364 Source advisory: OSV:GHSA-8XFF-473H-F863...
emulsion (>=6.0.0, <=10.0.0), libavif-sys (>=0.8.0, <=0.15.0) +1 more potentially affected by unknown CVE via libdav1d-sys (>=0.2.0, <=0.6.0)
libdav1d-sys CARGO version =0.2.0, =6.0.0, =0.8.0, =0.9.4, =0.10.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0016...
libgit2-sys affected by memory corruption, denial of service, and arbitrary code execution in libgit2
The libgit2 project fixed three security issues in the 1.7.2 release. These issues are: The gitrevparsesingle function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the...
RUSTSEC-2024-0014 `generational-arena` is unmaintained
The generational-arena crate's repository has been archived and is no longer maintained. Alternatives - slotmap...
SUSE SLED15: bouncycastle / bouncycastle-javadoc / bouncycastle-jmail / etc (SUSE-SU-2024:0327-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0327-1 advisory. - Updated jsch to version 0.2.15: - CVE-2023-48795: Fixed a prefix truncation issue that could lead to...
GHSA-F56G-CHQP-22M9 Use after free in libpulse-binding
Overview Version 2.5.0 of the libpulse-binding Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a proplist::Iterator to the Proplist object for which it was created...
Use after free in libpulse-binding
Overview Version 2.5.0 of the libpulse-binding Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a proplist::Iterator to the Proplist object for which it was created...
The vulnerability of the software for managing and configuring connected ASUS Armory Crate devices, related to errors in processing hypertext links, allows a perpetrator to gain unauthorized access to arbitrary files.
The vulnerability of the software for managing and configuring connected ASUS Armory Crate devices is related to errors in processing hypertext links. Exploiting this vulnerability can allow an attacker to gain unauthorized access to arbitrary files...
GHSA-4JWQ-572W-4388 Memory over-allocation in evm crate
Impact Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. Patches The flaw was corrected in comm...
Memory over-allocation in evm crate
Impact Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. Patches The flaw was corrected in comm...
PYSEC-2024-27
CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and Local In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI...
RUSTSEC-2024-0396 `conrod_core` is unmaintained
The conrodcore crate is no longer maintained. The author suggests egui as a potential alternative...
PT-2024-40943 · Unknown +1 · Conrod Core +1
Name of the Vulnerable Software and Affected Versions: conrod versions 0.62.0 and earlier Description: The issue concerns the conrod crate, which has been deprecated since version 0.62.0. Its functionality was split across multiple crates, with core functionality transferred to conrod core. If...
Debian dla-3719 : php-seclib - security update
The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3719 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3719-1 [email protected] https://www.debian.org/lts/security/...
objstor (>=0.4.6, <=0.4.20), rblog (>=0.100.0, <=0.123.0) +18 more potentially affected by CVE-2024-23644 via trillium-http (>=0.2.14, <=0.3.3)
trillium-http CARGO version =0.2.14, =0.4.6, =0.100.0, =0.2.0, =0.2.0-rc.1, =0.1.0, =0.2.0, =0.0.1, =0.2.0, =0.2.0, =0.3.0, =0.3.1 and more Source cves: CVE-2024-23644 Source advisory: OSV:GHSA-9F9P-CP3C-72JF...
PT-2025-31024 · Snow · Snow
Name of the Vulnerable Software and Affected Versions: snow crate versions prior to 0.9.5 Description: The snow crate, when using stateful TransportState, allows incrementing a nonce, potentially leading to denial of message delivery. Recommendations: Update to snow crate version 0.9.5 or later...
PT-2025-31025 · Shlex +1 · Shlex +1
Name of the Vulnerable Software and Affected Versions: shlex crate versions prior to 1.2.1 Description: The shlex crate before version 1.2.1 for Rust allows unquoted and unescaped instances of the and xa0 characters, which may facilitate command injection. Recommendations: Update the shlex crate ...
GHSA-58J9-J2FJ-V8F4 SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface
SurrealDB depends on the tungstenite and tokio-tungstenite crates used by the axum crate, which handles connections to the SurrealDB WebSocket interface. On versions before 0.20.1, the tungstenite crate presented an issue which allowed the parsing of HTTP headers during the client handshake to...
