CVE-2024-32884 affecting package rust for versions less than 1.72.0-8

CVE-2024-32884 affecting package rust for versions less than 1.72.0-8. A patched version of the package is available...

CVE-2024-43367 Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects

Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts. Boa's implementation of AsyncGenerator...

CVE-2024-43367 Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects

Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts. Boa's implementation of AsyncGenerator...

abacuz (0.1.1), acme-dns-rust (>=1.0.0, <=1.1.6) +309 more potentially affected by unknown CVE via sqlx (>=0.2.6, <=0.8.0)

sqlx CARGO version =0.2.6, =1.0.0, =0.0.2, =0.11.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0-beta.0, =0.3.0-beta.0, =0.4.3 - appenddbpostgres 0.2.0 - aquadoggo 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0363...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2024-43410 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2024-43410 Source advisory: OSV:GHSA-VGVV-X7XG-6CQG...

Russh has an OOM Denial of Service due to allocation of untrusted amount

Summary Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. Details An SSH packet consists of a 4-byte big-endian length, followed by a byte stream of this length. After parsing and potentially decrypting the 4-byte length, russh allocates enough memory...

boa_cli (0.16.0), click_and_load (0.2.0) +1 more potentially affected by CVE-2024-43357 +1 more via boa_engine (0.16.0)

boaengine CARGO version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on boaengine and may be impacted: - boacli 0.16.0 - clickandload 0.2.0 - zippyst 5.0.0 Source cves: CVE-2024-43357, CVE-2024-43367 Source advisory: OSV:GHSA-F67Q-WR6W-23JQ...

CVE-2024-31852 affecting package rust for versions less than 1.75.0-9

CVE-2024-31852 affecting package rust for versions less than 1.75.0-9. A patched version of the package is available...

CVE-2024-32884 affecting package rust for versions less than 1.75.0-9

CVE-2024-32884 affecting package rust for versions less than 1.75.0-9. A patched version of the package is available...

CVE-2024-31852 affecting package rust for versions less than 1.75.0-9

CVE-2024-31852 affecting package rust for versions less than 1.75.0-9. A patched version of the package is available...

CVE-2024-32884 affecting package rust for versions less than 1.75.0-9

CVE-2024-32884 affecting package rust for versions less than 1.75.0-9. A patched version of the package is available...

databend-common-ast (>=0.0.0, <=0.0.2), foyer-common (>=0.8.0, <=0.8.1) +12 more potentially affected by unknown CVE via minitrace (>=0.3.1, <=0.6.7)

minitrace CARGO version =0.3.1, =0.0.0, =0.8.0, =0.8.0, =0.1.7, =0.3.0, =0.6.4, =0.3.0, =0.5.0, =0.11.1, =0.11.1, =0.3.0, =0.1.0, =0.1.1 - risinglight 0.1.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0390...

boa_cli (0.16.0), click_and_load (0.2.0) +1 more potentially affected by CVE-2024-43357 +1 more via boa_engine (0.16.0)

boaengine CARGO version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on boaengine and may be impacted: - boacli 0.16.0 - clickandload 0.2.0 - zippyst 5.0.0 Source cves: CVE-2024-43357, CVE-2024-43367 Source advisory: OSV:RUSTSEC-2024-0444...

Sonos Speaker Flaws Could Have Let Remote Hackers Eavesdrop on Users

Cybersecurity researchers have uncovered weaknesses in Sonos smart speakers that could be exploited by malicious actors to clandestinely eavesdrop on users. The vulnerabilities "led to an entire break in the security of Sonos's secure boot process across a wide range of devices and remotely being...

cosmwasm-check (>=1.1.0-rc.1, <=1.3.4), cw-check-contract (1.0.1) +4 more potentially affected by unknown CVE via cosmwasm-vm (>=1.2.8, <=1.3.4)

cosmwasm-vm CARGO version =1.2.8, =1.1.0-rc.1, =0.5.3-2, =0.6.0-beta1, =0.17.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0361...

ROS-20240805-02

A vulnerability in the implementation of the application program interface of the Rust programming language interpreter for Windows operating systems is related to the introduction or modification of arguments. Windows operating systems is related to the introduction or modification of arguments...

CVE-2024-41949

biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...

CVE-2024-41949 biscuit-rust vulnerable to public key confusion in third party block

biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...

CVE-2024-41949 biscuit-rust vulnerable to public key confusion in third party block

biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...

CVE-2024-41949

Biscuit-rust is affected by a public key confusion in third-party blocks. A forged ThirdPartyBlock request can trick a third-party authority into generating datalog that trusts the wrong keypair, enabling under-specified trust relationships. The issue is described across multiple sources (CVE-202...