Archive
9 September 2019
Vulnerabilities first published on this day (UTC), newest first.
97 results · Feed
-
High 7.5
Uninitialized memory use in generator
An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls.
-
Critical 9.8
Algorithms compute incorrect results in blake2
An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes.
-
Critical 9.8
Improper Input Validation in renderdoc
An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application.
-
High 7.5
Improper Input Validation in once_cell
An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy.
-
Critical 9.8
Out of bounds access in compact_arena
An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or read.
-
Critical 9.8
Use after free in image
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
-
High 7.5
Wrong memory orderings violates mutual exclusion in spin
An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion.
-
Medium 6.1
Cross-site Scripting in YII2-CMS
YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
-
Unscored —
framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file fr…
-
Unscored —
An issue was discovered in OKLite v1.2.25. framework/admin/tpl_control.php allows remote attackers to delete arbitrary …
-
Unscored —
An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwo…
-
Unscored —CVE-2019-16124 EPSS 28%
In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to…
-
Unscored —
In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL inje…
-
Medium 6.1
Cross-site Scripting in Grav
Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
-
Unscored —
In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File …
-
Unscored —
sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.
-
Critical 9.8
Use-after-free in chttp
An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.