CVE-2021-38186

The CVE-2021-38186 entry concerns the comrak crate for Rust, affected in versions before 0.10.1. The issue stems from improper handling of the & character, which can cause cross-site scripting (XSS) via HTML entities like &#. The vulnerability is described across multiple sources (e.g., Red Hat, ...

CVE-2021-38187

CVE-2021-38187 affects the Rust anymap crate up to version 0.12.1, with a soundness flaw caused by converting a *u8 to a *u64. Public records (NVD, OSV, GHSA, CNVD) describe this as a high‑/critical impact vulnerability; CVSSv3.1 base score 9.8 indicates CRITICAL severity and network attack vecto...

CVE-2021-38187

An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a u8 to a u64...

CVE-2021-38188

An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new, slice.getuncheckedslice.length is used unsafely...

CVE-2021-38189

An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two sequences and then inject arbitrary SMTP commands...

CVE-2021-38189

The CVE-2021-38189 issue affects the lettre crate (Rust) prior to 0.9.6. In the body of an email, an attacker can place a dot after two consecutive CRLF sequences, enabling arbitrary SMTP command injection after the message ends. This represents a control-flow vulnerability in SMTP handling rathe...

CVE-2021-38190

An issue was discovered in the nalgebra crate before 0.27.1 for Rust. It allows out-of-bounds memory access because it does not ensure that the number of elements is equal to the product of the row count and column count...

CVE-2021-38191

An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread...

CVE-2021-38191

CVE-2021-38191 concerns the tokio crate (pre-1.8.1) for Rust. The issue occurs when calling JoinHandle::abort: a Task may be dropped in the wrong thread, which, as discussed in related advisories, can create race conditions—especially for tasks that rely on thread-affine constructs like Rc or Ref...

CVE-2021-38191

An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread...

CVE-2021-38193

CVE-2021-38193 : A cross-site scripting vulnerability exists in the ammonia crate for Rust, prior to version 3.1.0. The issue arises from mishandled parsing differences between HTML, SVG, and MathML, enabling an attacker to inject malicious scripts. The vulnerability is related to, and similar in...

CVE-2021-38193

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870...

CVE-2021-38193

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870...

CVE-2021-38194

An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mulbyinverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified...

CVE-2021-38196

CVE-2021-38196 relates to the Rust crate better-macro , where a deliberate RCE via proc-macros was demonstrated through 2021-07-22. The connected documents confirm remote code execution potential and a purposefully malicious context, with coverage across RustSec, GHSA, OSV, and national advisorie...

Rust 缓冲区错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in Mozilla Rust versions prior to 0.1.5, which stems from a software libsbc crate that implements Send for any Decoder , for any R: Read, and can be exploited by an attacke...

Rust 安全漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. a memory corruption vulnerability exists in Mozilla Rust, which stems from Rust's scottqueue crate. for Queue there is an unconditional send and sync implementation, which can be exploited by an attacker to caus...

Rust 安全漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A denial-of-service vulnerability exists in max7301 crate in versions of Mozilla Rust prior to 0.2.0, which can be exploited by attackers to cause data contention by sending specially crafted requests...

Rust 命令注入漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that originates in Rust's punch crate, which has an unconditional send and sync implementation for Bunch , and can be exploited to cause memory...

Rust 命令注入漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Rust suffers from a command injection vulnerability that stems from the cache crate in Rust having an unconditional send and synchronization implementation for cache...