`read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)

Affected versions of this crate calls a user provided Read implementation on an uninitialized buffer. Read on uninitialized buffer is defined as undefined behavior in Rust...

binjs_es6 (0.2.1) potentially affected by CVE-2021-45683 via binjs_io (0.2.1)

binjsio CARGO version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on binjsio and may be impacted: - binjses6 0.2.1 Source cves: CVE-2021-45683 Source advisory: OSV:GHSA-C6PX-4GRW-HRJR...

a2d (>=0.1.0, <=0.1.11), acidalia (>=0.1.0, <=0.1.3) +280 more potentially affected by CVE-2021-45688 via ash (>=0.24.4, <=0.32.1)

ash CARGO version =0.24.4, =0.1.0, =0.1.0, =0.0.1, =0.1.2, =0.1.0, =0.5.4-rc.1, =0.2.0, =0.1.0, =0.1.3, =0.1.4 - aravis-utils 0.7.0 and more Source cves: CVE-2021-45688 Source advisory: OSV:GHSA-QJ69-C89V-JWQ2...

`array!` macro is unsound in presence of traits that implement methods it calls internally

Affected versions of this crate called some methods using auto-ref. The affected code looked like this. rust let mut arr = $crate::core::mem::MaybeUninit::uninit; let mut vec = $crate::ArrayVec::::newarr.asmutptr as mut T; In this case, the problem is that asmutptr is a method of &mut MaybeUninit...

GHSA-HFXP-P695-629X abomonation transmutes &T to and from &[u8] without sufficient constraints

This transmute is at the core of the abomonation crates. It's so easy to use it to violate alignment requirements that no test in the crate's test suite passes under miri. The use of this transmute in serialization/deserialization also incorrectly assumes that the layout of a reprRust type is...

abomonation_derive (>=0.1.0, <=0.5.0), abomonation_derive_ng (0.1.0) +30 more potentially affected by CVE-2021-45708 via abomonation (>=0.4.6, <=0.7.3)

abomonation CARGO version =0.4.6, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.1.0, =0.2.0, =0.3.1 and more Source cves: CVE-2021-45708 Source advisory: OSV:GHSA-HFXP-P695-629X...

abomonation transmutes &T to and from &[u8] without sufficient constraints

This transmute is at the core of the abomonation crates. It's so easy to use it to violate alignment requirements that no test in the crate's test suite passes under miri. The use of this transmute in serialization/deserialization also incorrectly assumes that the layout of a reprRust type is...

a3mo_lib (>=0.1.0, <=0.1.1), aaa_csv_challenge (0.1.0) +6422 more potentially affected by CVE-2019-25010 +1 more via failure (>=0.1.0, <=0.1.8)

failure CARGO version =0.1.0, =0.1.0, =0.0.1, =0.1.0-pre.1, =0.5.0, =0.3.0, =0.3.0-alpha.1, =0.1.0, =0.2.0-alpha.2 - accept-encoding-fork 0.2.0-alpha.3 and more Source cves: CVE-2019-25010, CVE-2020-25575 Source advisory: OSV:GHSA-JQ66-XH47-J9F3...

Type confusion if __private_get_type_id__ is overriden

An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap...

CVE-2022-31053

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

Authentication flaw

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid G-signatures. Such an attack would allow an attacker to create a token with any access level. The...

The many lives of BlackCat ransomware

The BlackCat ransomware, also known as ALPHV, is a prevalent threat and a prime example of the growing ransomware-as-a-service RaaS gig economy. It’s noteworthy due to its unconventional programming language Rust, multiple target devices and possible entry points, and affiliation with prolific...

The many lives of BlackCat ransomware

The BlackCat ransomware, also known as ALPHV, is a prevalent threat and a prime example of the growing ransomware-as-a-service RaaS gig economy. It’s noteworthy due to its unconventional programming language Rust, multiple target devices and possible entry points, and affiliation with prolific...

abc (>=0.1.0, <=0.2.3), aerospike (>=0.0.1, <=1.3.0) +314 more potentially affected by unknown CVE via crossbeam (>=0.1.6, <=0.2.12)

crossbeam CARGO version =0.1.6, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.4.0, =0.0.6, =0.0.9 - bio 0.3.13 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RWF4-GX62-RQFW...

abc (>=0.1.0, <=0.2.3), aerospike (>=0.0.1, <=1.3.0) +314 more potentially affected by unknown CVE via crossbeam (>=0.1.6, <=0.2.12)

crossbeam CARGO version =0.1.6, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.4.0, =0.0.6, =0.0.9 - bio 0.3.13 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0029...

Exploit for Uncontrolled Resource Consumption in Rust-Lang Regex

POC of CVE-2022-24713 on Ubuntu Install the current rust-regex...

admin-gp (>=1.0.0-beta, <=1.0.4-beta), aspiesolutions_core (>=0.0.1-alpha+3, <=0.0.1-alpha.11) +41 more potentially affected by CVE-2021-20332 via mongodb (1.2.5)

mongodb CARGO version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on mongodb and may be impacted: - admin-gp =1.0.0-beta, =0.0.1-alpha+3, =1.0.0, =1.1.0, =1.6.2, =0.12.8, =0.3.0, =0.4.2, =0.1.0-pre-alpha.1, =0.1.0, =1.0.0-beta, =0.1.0, =0.3.1 an...

GHSA-4RJR-3GJ2-5CRQ Exposure of Sensitive Information to an Unauthorized Actor in MongoDB Rust Driver

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credential...

Exposure of Sensitive Information to an Unauthorized Actor in MongoDB Rust Driver

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credential...

GHSA-J8Q9-5RP9-4MV9 Fix a use-after-free bug in diesels Sqlite backend

An issue was discovered in the diesel crate before 1.4.6 for Rust. There is a use-after-free in the SQLite backend because the semantics of sqlite3columnname are not followed...