CVE-2021-38190

CVE-2021-38190 affects the Rust crate nalgebra prior to 0.27.1, where out-of-bounds memory access can occur because the number of elements is not guaranteed to equal nrows * ncols during deserialization or storage handling. The issue is caused by an invariant not being maintained in the matrix/ve...

CVE-2021-38191

An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread...

CVE-2021-38191

An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread...

CVE-2021-38191

CVE-2021-38191 concerns the tokio crate (pre-1.8.1) for Rust. The issue occurs when calling JoinHandle::abort: a Task may be dropped in the wrong thread, which, as discussed in related advisories, can create race conditions—especially for tasks that rely on thread-affine constructs like Rc or Ref...

CVE-2021-38192

An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime...

CVE-2021-38192

CVE-2021-38192 affects the Rust crate prost-types prior to 0.8.0, where converting a Timestamp to SystemTime can overflow and panic. The issue is addressed by upgrading to prost-types v0.8 and switching the From for SystemTime usage to TryFrom for SystemTime. The vulnerability is described across...

CVE-2021-38193

CVE-2021-38193 : A cross-site scripting vulnerability exists in the ammonia crate for Rust, prior to version 3.1.0. The issue arises from mishandled parsing differences between HTML, SVG, and MathML, enabling an attacker to inject malicious scripts. The vulnerability is related to, and similar in...

CVE-2021-38194

The CVE-2021-38194 issue affects the ark-r1cs-std crate for Rust (versions before 0.3.1). FieldVar::mul_by_inverse does not enforce constraints, allowing a malicious prover to produce an unsound proof that still verifies. The problem is caused by missing constraint checks in this method, compromi...

CVE-2021-38195

The CVE-2021-38195 issue affects the libsecp256k1 crate for Rust, specifically versions before 0.5.0. The root cause is an overflow where the R or S parameter can be larger than the curve order, allowing an invalid signature to be verified. This vulnerability is described in multiple connected re...

CVE-2021-38196

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose...

CVE-2021-38196

CVE-2021-38196 relates to the Rust crate better-macro , where a deliberate RCE via proc-macros was demonstrated through 2021-07-22. The connected documents confirm remote code execution potential and a purposefully malicious context, with coverage across RustSec, GHSA, OSV, and national advisorie...

Rust 安全漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. playXE/cgc for Mozilla Rust suffers from a denial-of-service vulnerability that can be exploited by attackers to cause data contention...

Rust 命令注入漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Rust suffers from a command injection vulnerability that stems from the cache crate in Rust having an unconditional send and synchronization implementation for cache...

Rust 缓冲区错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in Mozilla Rust versions prior to 0.1.5, which stems from a software libsbc crate that implements Send for any Decoder , for any R: Read, and can be exploited by an attacke...

Rust 缓冲区错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust suffers from a memory corruption vulnerability that can be exploited by attackers to cause undefined behavior, such as data contention...

Rust 竞争条件问题漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Mozilla Rust is vulnerable to a command injection vulnerability that can be exploited by attackers to cause memory corruption...

Rust 缓冲区错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A code execution vulnerability exists in nalgebra crate prior to Mozilla Rust 0.27.1, which stems from the failure of nalgebra crate to ensure that the number of elements equals the product of the number of rows...

Rust 安全漏洞

A security vulnerability exists in the Iced-x86 crate of Mozilla Rust version 1.10.3, which could be exploited by attackers to launch further attacks on the system...

Rust 命令注入漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation.Mozilla Rust versions prior to 0.3.4 are vulnerable to command injection, which stems from the kekbit crate in Rust, for ShmWriter , Send is implemented without H: Send, and an attacker could exploit this...

Rust 安全漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. playXE/cgc for Mozilla Rust suffers from a memory corruption vulnerability that can be exploited by attackers to cause data contention...