Invalid Slice Split Results in Server Panic

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients. Impact An attacker with knowledge of this vulnerability could craft and...

bridge_lmdb (0.1.0), ithos (0.0.0) +3 more potentially affected by unknown CVE via lmdb-rs (0.7.6)

lmdb-rs CARGO version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on lmdb-rs and may be impacted: - bridgelmdb 0.1.0 - ithos 0.0.0 - sanakirja =1.0.0, =0.1.0, =0.1.0, =0.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-F9G6-FP84-FV92...

bridge_lmdb (0.1.0), ithos (0.0.0) +3 more potentially affected by unknown CVE via lmdb-rs (0.7.6)

lmdb-rs CARGO version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on lmdb-rs and may be impacted: - bridgelmdb 0.1.0 - ithos 0.0.0 - sanakirja =1.0.0, =0.1.0, =0.1.0, =0.3.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0047...

urlnorm 安全漏洞

urlnorm is a URL normalization library for Rust open sourced by progscrape. A security vulnerability exists in urlnorm version 0.1.4 and earlier, which stems from a vulnerability that allows a regular expression denial of service ReDos via a crafted lib.rs URL...

servicos.seduc.rs.gov.br Cross Site Scripting vulnerability OBB-3435570

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.

...

SUSE CVE-2023-34411

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service panic via an invalid ! token such as !DOCTYPEs/%!A nesting in an XML document. The earliest affected version is 0.8.9...

GHSA-7GF7-JV65-WJMH xml-rs vulnerable to denial of service via invalid token in XML document

The xml-rs crate = 0.8.9 and 0.8.14 for Rust and Crab allows a denial of service panic via an invalid ! token such as !DOCTYPEs/%!A nesting in an XML document...

xml-rs vulnerable to denial of service via invalid token in XML document

The xml-rs crate = 0.8.9 and 0.8.14 for Rust and Crab allows a denial of service panic via an invalid ! token such as !DOCTYPEs/%!A nesting in an XML document...

CVE-2023-34411

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service panic via an invalid...

CVE-2023-34411

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service panic via an invalid ! token such as !DOCTYPEs/%!A nesting in an XML document. The earliest affected version is 0.8.9...

CVE-2023-34411

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service panic via an invalid ! token such as !DOCTYPEs/%!A nesting in an XML document. The earliest affected version is 0.8.9...

CVE-2023-34411

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service panic via an invalid ! token such as !DOCTYPEs/%!A nesting in an XML document. The earliest affected version is 0.8.9...

CVE-2023-34411

The CVE-2023-34411 issue affects the xml-rs crate for Rust (and Crab), with versions before 0.8.14 vulnerable to a denial-of-service (panic) caused by an invalid XML token, such as a malformed

CVE-2023-33192

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...

Design/Logic Flaw

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...

CVE-2023-33192 Improper handling of NTS cookie length that could crash the ntpd-rs server

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...

CVE-2023-33192

CVE-2023-33192 affects ntpd-rs, a Rust NTP implementation. The issue is improper handling/validation of NTS cookie length in NTP packets, allowing a specially crafted cookie to crash the ntpd-rs server (also observed when the server is not configured to handle NTS). Root cause: unsafe or faulty s...

CVE-2023-33192 Improper handling of NTS cookie length that could crash the ntpd-rs server

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...

ntpd-rs 安全漏洞

ntpd-rs is a full-featured implementation of the Network Time Protocol, including NTS support. A security vulnerability exists in ntpd-rs versions 0.3.0 through 0.3.2, which stems from the fact that ntpd-rs does not validate the length of the NTS cookie in NTP packets received from the server,...