auto-wasi (=0.1.0), candid-extractor (>=0.1.0 <=0.1.2) +99 more potentially affected by CVE-2022-39394 via wasmtime (>=0.10.0 <=12.0.2)

wasmtime CARGO version =0.10.0, =0.1.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0, =0.4.0, =0.0.0, =0.5.0, =0.0.1-alpha, =0.40.1, =0.45.0, =0.1.0, =0.3.0 - inkpad-executor =0.1.0 and more Source cves: CVE-2022-39394 Source advisory: OSV:GHSA-H84Q-M8RR-3V9Q...

chimper (>=0.3.0 <=0.4.0), conrod_example_shared (>=0.62.0 <=0.76.1) +26 more potentially affected by unknown CVE via conrod_core (>=0.62.0 <=0.76.1)

conrodcore CARGO version =0.62.0, =0.3.0, =0.62.0, =0.0.1, =0.62.0, =0.62.0, =0.62.0, =0.1.0, =0.1.0, =0.62.0, =0.69.0, =0.62.0, =0.2.1, =0.1.0, =0.24.0, =0.1.0, =0.25.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0396...

carpo (>=0.1.2 <=0.1.3), chimper (>=0.1.2 <=0.2.1) +7 more potentially affected by unknown CVE via conrod (>=0.51.1 <=0.61.1)

conrod CARGO version =0.51.1, =0.1.2, =0.1.2, =0.1.0, =1.0.0, =0.1.0, =0.2.0, =1.0.0, =0.1.0, =0.1.4 - turbine =0.0.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0397...

objstor (>=0.4.6 <=0.4.20), rblog (>=0.100.0 <=0.123.0) +16 more potentially affected by CVE-2024-23644 via trillium-http (=0.2.14)

trillium-http CARGO version =0.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on trillium-http and may be impacted: - objstor =0.4.6, =0.100.0, =0.2.0, =0.2.0-rc.1, =0.1.0, =0.2.0, =0.0.1, =0.2.0, =0.3.0, =0.2.0, =0.3.1, =0.4.2 and more Source cves:...

objstor (>=0.4.6 <=0.4.20), rblog (>=0.100.0 <=0.123.0) +16 more potentially affected by CVE-2024-23644 via trillium-http (=0.2.14)

trillium-http CARGO version =0.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on trillium-http and may be impacted: - objstor =0.4.6, =0.100.0, =0.2.0, =0.2.0-rc.1, =0.1.0, =0.2.0, =0.0.1, =0.2.0, =0.3.0, =0.2.0, =0.3.1, =0.4.2 and more Source cves:...

Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

RustProject (=0.1.0), SOEM-sys (=0.2.0) +2132 more potentially affected by CVE-2024-58266 via shlex (>=0.1.1 <=1.1.0)

shlex CARGO version =0.1.1, =0.1.0, =0.1.0, =0.0.9, =0.0.13 - aigcapi =5.1.2 - aigcchain =5.1.2 - aigcconfig =5.1.2 and more Source cves: CVE-2024-58266 Source advisory: OSV:RUSTSEC-2024-0006...

areq (=0.1.0-alpha), bws-web-server (>=0.1.0 <=0.1.1) +26 more potentially affected by unknown CVE via h2 (=0.4.14)

h2 CARGO version =0.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - areq =0.1.0-alpha - bws-web-server =0.1.0, =0.5.2, =0.1.0, =1.0.0, =1.5.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.0 and more Source cves: unknown CVE Sourc...

BeerHolderBot (>=0.1.0 <=0.3.6), GetPDB (>=0.1.0 <=1.0.1) +4593 more potentially affected by unknown CVE via h2 (>=0.1.26 <=0.3.21)

h2 CARGO version =0.1.26, =0.1.0, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.2.0-alpha.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-8R5V-VM4M-4G25...

arcon_compiler (>=0.1.0 <=0.1.1), astrology (>=0.1.0 <=0.1.55) +18 more potentially affected by unknown CVE via ferris-says (>=0.1.2 <=0.2.1)

ferris-says CARGO version =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =10.10.10 and more Source cves: unknown CVE Source advisory: OSV:GHSA-V363-RRF2-5FMJ...

BeerHolderBot (>=0.1.0 <=0.3.6), GetPDB (>=0.1.0 <=1.0.1) +4593 more potentially affected by CVE-2019-9514 via h2 (>=0.1.26 <=0.3.21)

h2 CARGO version =0.1.26, =0.1.0, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.2.0-alpha.0 and more Source cves: CVE-2019-9514 Source advisory: OSV:RUSTSEC-2024-0003...

areq (=0.1.0-alpha), bws-web-server (>=0.1.0 <=0.1.1) +26 more potentially affected by CVE-2019-9514 via h2 (=0.4.14)

h2 CARGO version =0.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - areq =0.1.0-alpha - bws-web-server =0.1.0, =0.5.2, =0.1.0, =1.0.0, =1.5.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.0 and more Source cves: CVE-2019-9514...

aries-askar (=0.1.2), indy-credx (>=0.2.0 <=0.3.1) +5 more potentially affected by CVE-2024-22192 via ursa (>=0.3.6 <=0.3.7)

ursa CARGO version =0.3.6, =0.2.0, =0.5.0, =0.3.1, =0.1.0, =0.1.0, =0.0.6, =0.0.8 Source cves: CVE-2024-22192 Source advisory: OSV:GHSA-6698-MHXX-R84G...

crabsay (>=0.1.0 <=0.1.1), craterfinder (>=0.1.0 <=0.1.1) +11 more potentially affected by unknown CVE via ferris-says (=0.2.1)

ferris-says CARGO version =0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on ferris-says and may be impacted: - crabsay =0.1.0, =0.1.0, =0.1.0, =0.1.1 - rs-lean =0.1.0 - rust-study =0.1.0 - rustbyexample =0.2.0 - rusty-grep =0.1.0 - rusty-redis...

alerter (>=0.3.0 <=0.3.1), maruc (=0.1.0) +9 more potentially affected by CVE-2024-52813 via matrix-sdk-crypto (>=0.1.0 <=0.5.0)

matrix-sdk-crypto CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 Source cves: CVE-2024-52813 Source advisory: OSV:RUSTSEC-2024-0434...

RUSTSEC-2023-0124 `bit-flags` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user alexrichton to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer...

`bit-flags` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user alexrichton to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer...

async-ssh2-tokio (>=0.2.0 <=0.8.4), dev-tunnels (=0.1.0) +5 more potentially affected by CVE-2023-48795 via russh (>=0.34.0 <=0.39.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - tunnels =0.1.0 Source cves: CVE-2023-48795 Source advisory: OSV:GHSA-45X7-PX36-X8W8...

at51 (>=0.1.1 <=0.4.1), atrac3p-decoder (>=0.1.0 <=0.1.2) +51 more potentially affected by CVE-2023-53156 via transpose (=0.1.0)

transpose CARGO version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transpose and may be impacted: - at51 =0.1.1, =0.1.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =2.6.2, =0.6.0, =0.1.0, =0.1.0, =0.1.1 and more Source...