PT-2020-17621

Name of the Vulnerable Software and Affected Versions abox crate versions prior to 0.4.1 Description An issue in the abox crate allows the implementation of Send and Sync for AtomicBox without requiring T: Send and T: Sync. This enables the creation of data races to T: !Sync and sending T: !Send ...

PT-2020-17638 · Rust · Lever

Name of the Vulnerable Software and Affected Versions: lever crate versions prior to 0.1.1 Description: The issue concerns the implementation of the Send and Sync traits for all types T by AtomicBox, which is designed for use across threads. This implementation allows non-Send types, such as Rc,...

PT-2020-17589

Name of the Vulnerable Software and Affected Versions may queue versions through 2020-11-10 Description An issue in the may queue crate for Rust can cause memory corruption due to the lack of bounds on its Send trait or Sync trait. This allows non-Sync types, such as Cell, to be shared across...

PT-2020-17587

Name of the Vulnerable Software and Affected Versions hashconsing versions prior to 1.1.0 Description The issue arises from the hashconsing crate's implementation of Send and Sync traits for its HConsed type without proper restrictions. This allows non-Sync types, such as Cell, to be shared acros...

TreeFocus lacks bounds on its Send and Sync traits

Affected versions of im contains TreeFocus that unconditionally implements Send and Sync. This allows a data race in safe Rust code if TreeFocus is extracted from Focus type. Typical users that only use Focus type are not affected...

RUSTSEC-2020-0096 TreeFocus lacks bounds on its Send and Sync traits

Affected versions of im contains TreeFocus that unconditionally implements Send and Sync. This allows a data race in safe Rust code if TreeFocus is extracted from Focus type. Typical users that only use Focus type are not affected...

RUSTSEC-2020-0070 Some lock_api lock guard objects can cause data races

Affected versions of lockapi had unsound implementations of the Send or Sync traits for some guard objects, namely: MappedMutexGuard MappedRwLockReadGuard MappedRwLockWriteGuard RwLockReadGuard RwLockWriteGuard These guards could allow data races through types that are not safe to Send across...

Some lock_api lock guard objects can cause data races

Affected versions of lockapi had unsound implementations of the Send or Sync traits for some guard objects, namely: MappedMutexGuard MappedRwLockReadGuard MappedRwLockWriteGuard RwLockReadGuard RwLockWriteGuard These guards could allow data races through types that are not safe to Send across...

PT-2020-17545

Name of the Vulnerable Software and Affected Versions lock api versions prior to 0.4.2 Description The issue is related to unsound implementations of the Send or Sync traits for certain guard objects in the lock api crate, including MappedMutexGuard, MappedRwLockReadGuard, MappedRwLockWriteGuard,...

PT-2020-22122

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of "Use-of-uninitialized-value" as reported by OSS-Fuzz. The crash state includes functions such as memory test, fuzze...

WS-2020-0189

Affected versions of futures-rs had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U. This could of led to data races in safe Rust code when a closure used in MutexGuard::map returns U that is unrelated to T. The issue wa...

RUSTSEC-2020-0072 GenericMutexGuard allows data races of non-Sync types across threads

GenericMutexGuard was given the Sync auto trait as long as T is Send due to its contained members. However, since the guard is supposed to represent an acquired lock and allows concurrent access to the underlying data from different threads, it should only be Sync when the underlying data is. Thi...

RUSTSEC-2020-0113 AtomicOption should have Send + Sync bound on its type argument.

In the affected versions of this crate, AtomicOption unconditionally implements Sync. This allows programmers to move non-Sync types across thread boundaries e.g. Rc, Arc, which can lead to data races and undefined behavior. It is also possible to send non-Send types like std::sync::MutexGuard to...

AtomicOption should have Send + Sync bound on its type argument.

In the affected versions of this crate, AtomicOption unconditionally implements Sync. This allows programmers to move non-Sync types across thread boundaries e.g. Rc, Arc, which can lead to data races and undefined behavior. It is also possible to send non-Send types like std::sync::MutexGuard to...

CVE-2020-24708

Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the Host field on the send profile form...

Cross site scripting

Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the Host field on the send profile form...

CVE-2020-24708

Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the Host field on the send profile form...

RUSTSEC-2020-0122 beef::Cow lacks a Sync bound on its Send trait allowing for data races

Affected versions of this crate did not have a T: Sync bound in the Send impl for Cow. This allows users to create data races by making Cow contain types that are Send && !Sync like Cell or RefCell. Such data races can lead to memory corruption. The flaw was corrected in commit d1c7658 by adding...

CVE-2020-24708: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the Host field on the send profile form...

PT-2020-15819

Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.11.0 Description The issue is related to a Cross Site Scripting XSS vulnerability. It occurs via the Host field on the send profile form. Recommendations For versions prior to 0.11.0, update to version 0.11.0 or lat...