roaring-landmask (0.4.0) potentially affected by CVE-2022-2097 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-2097 Source advisory: OSV:RUSTSEC-2022-0032...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +82 more potentially affected by CVE-2022-23636 +1 more via wasmtime (>=0.7.0, <=0.37.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0-pre, =0.4.0-pre, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.3.0 - inkpad-executor 0.1.0 and more Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:RUSTSEC-2022-0101...

abstraps (0.1.8), aivm (>=0.2.0, <=0.3.0) +287 more potentially affected by CVE-2022-31104 via cranelift-codegen (>=0.14.0, <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-31104 Source advisory: OSV:GHSA-JQWC-C49R-4W2X...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +82 more potentially affected by CVE-2022-31104 via wasmtime (>=0.7.0, <=0.37.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0-pre, =0.4.0-pre, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.3.0 - inkpad-executor 0.1.0 and more Source cves: CVE-2022-31104 Source advisory: OSV:RUSTSEC-2022-0095...

amethyst (>=0.11.0, <=0.15.3), amethyst-console (0.1.0) +200 more potentially affected by unknown CVE via clipboard (>=0.1.2, <=0.5.0)

clipboard CARGO version =0.1.2, =0.11.0, =0.2.0, =0.1.0, =0.8.0, =0.6.0, =0.4.0, =0.8.0, =0.2.0, =0.6.0, =0.1.0, =1.4.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0056...

Malicious Package

Overview rust-functions is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious Package

Overview rust-docs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview example-rust is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

rulex-bin (>=0.1.0, <=0.3.0), rulex-macro (>=0.1.0, <=0.3.0) potentially affected by CVE-2022-31100 via rulex (>=0.1.0, <=0.3.0)

rulex CARGO version =0.1.0, =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2022-31100 Source advisory: OSV:GHSA-8V9W-P43C-R885...

MAL-2022-2912 Malicious code in example-rust (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ea3b88110c6d99f6f13c45a70f1a3a66f9c32da09f15db73f1a166c2cbfa080 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in example-rust (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ea3b88110c6d99f6f13c45a70f1a3a66f9c32da09f15db73f1a166c2cbfa080 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Use After Free in Context::start_auth_session

Impact This issue only applies to applications starting authorization sessions using an explicit initial nonce. When Context::startauthsession was called with a nonce argument value of Some..., the nonce pointer passed down through FFI to EsysStartAuthSession would be a dangling pointer, left ove...

GHSA-W3VW-CCC5-QR8V Use After Free in Context::start_auth_session

Impact This issue only applies to applications starting authorization sessions using an explicit initial nonce. When Context::startauthsession was called with a nonce argument value of Some..., the nonce pointer passed down through FFI to EsysStartAuthSession would be a dangling pointer, left ove...

GHSA-75RW-34Q6-72CR Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...

files (>=1.0.0, <=2.2.3), portal (>=2.0.0, <=3.0.1) potentially affected by CVE-2022-31053 via biscuit-auth (1.2.0)

biscuit-auth CARGO version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on biscuit-auth and may be impacted: - files =1.0.0, =2.0.0, =3.0.1 Source cves: CVE-2022-31053 Source advisory: OSV:GHSA-75RW-34Q6-72CR...

tremor-language-server (>=0.7.3, <=0.7.4) potentially affected by CVE-2021-45701 +1 more via tremor-script (0.7.2)

tremor-script CARGO version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on tremor-script and may be impacted: - tremor-language-server =0.7.3, =0.7.4 Source cves: CVE-2021-45701, CVE-2021-45702 Source advisory: OSV:GHSA-3PP4-64MP-9CG9...

buster (0.1.0), glog (0.1.0) +4 more potentially affected by unknown CVE via thread_local (1.0.1)

threadlocal CARGO version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on threadlocal and may be impacted: - buster 0.1.0 - glog 0.1.0 - simconnect 0.1.4 - skia-bindings =0.37.0, =0.37.0, =0.5.0, =0.5.1 Source cves: unknown CVE Source advisory:...

bencode (>=0.1.1, <=0.1.8), bincode (>=0.0.3, <=0.0.9) +49 more potentially affected by unknown CVE via rustc-serialize (>=0.1.5, <=0.3.22)

rustc-serialize CARGO version =0.1.5, =0.1.1, =0.0.3, =0.1.12, =0.1.2, =0.5.3, =0.5.2, =0.5.1, =0.1.4, =0.1.8, =0.6.41, =0.6.42 - docoptmacros 0.6.42 - email 0.0.9 - envelope 0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-2226-4V3C-CFF8...

Miscomputation when performing AES encryption in rust-crypto

The following Rust program demonstrates some strangeness in AES encryption - if you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. For these functions, we expect that extending a 16 byte key to a 32 byte k...

abstract-boot (>=0.2.0-beta.4, <=0.2.0-beta.7), ace-test-lib (0.1.0) +711 more potentially affected by unknown CVE via rust-crypto (0.2.36)

rust-crypto CARGO version 0.2.36 is affected by a known vulnerability. The following packages have a transitive dependency on rust-crypto and may be impacted: - abstract-boot =0.2.0-beta.4, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.8.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more...