Archive
December 2020
Vulnerabilities first published in this month (UTC), newest first.
85 results · Clear filters · Feed
-
Critical 9.8
Incorrect Comparison in sodiumoxide
An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties.
-
Critical 9.8
Unsound casting in flatbuffers
An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness.
-
Critical 9.8
Double free in http
An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.
-
Critical 9.8
Type confusion if __private_get_type_id__ is overriden
An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.
-
Critical 9.8
Out of bounds write in prost
An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message, causing a denial of service (e.g., x86) or possibly remote code execution (e.g., ARM).
-
Critical 9.1
Out of bounds access in lucet-runtime-internals
An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust. It mishandles sigstack allocation. Guest programs may be able to obtain sensitive information, or guest programs can experience memory corruption.
-
Critical 9.8
NULL Pointer Dereference in cbox
An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code.
-
Critical 9.8
Use after free and double free in bitvec
An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free.
-
Critical 9.8
HTTP Request Smuggling in hyper
An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.
-
Critical 9.8
Data races in rusqlite
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor.
-
Critical 9.8
Use after free in rio
An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race.
-
Critical 9.8
Drop of uninitialized memory in Ozone
An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of out-of-bounds access.
-
Critical 9.8
Data races in rulinalg
An issue was discovered in the rulinalg crate through 2020-02-11 for Rust. There are incorrect lifetime-boundary definitions for RowMut::raw_slice and RowMut::raw_slice_mut.
-
Critical 9.8
Unsoundness in bigint
An issue was discovered in the bigint crate through 2020-05-07 for Rust. It allows a soundness violation.
-
Critical 9.8
Out of bounds write in traitobject
An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers, possibly causing memory corruption in, for example, Rust 2.x.
-
Critical 9.1
Path traversal in mozwire
An issue was discovered in the mozwire crate through 2020-08-18 for Rust. A ../ directory-traversal situation allows overwriting local files that have .conf at the end of the filename.
-
Critical 9.8
Double free in alpm-rs
An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. StrcCtx performs improper memory deallocation.
-
Critical 9.8
Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr
An issue was discovered in the arr crate through 2020-08-25 for Rust. An attacker can smuggle non-Sync/Send types across a thread boundary to cause a data race.
-
Critical 9.1
Out of bounds read in simple-slab
An issue was discovered in the simple-slab crate before 0.3.3 for Rust. index() allows an out-of-bounds read.
-
Critical 9.8
Out-of-bounds write in stack
An issue was discovered in the stack crate before 0.3.1 for Rust. ArrayVec has an out-of-bounds write via element insertion.
-
Critical 9.1
Use after free in actix-utils
An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
-
Critical 9.8
Use-after-free in actix-codec
An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed.
-
Critical 9.8
HGiga MailSherlock - Broken Authentication
HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.
-
Critical 9.8
SQL Injection in NukeViet
modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).
-
Critical 9.8
Deserialization of Untrusted Data in NukeViet
includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk).
-
Critical 9.8
NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an unauthenticated attacker.
-
Critical 9.3
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1…
-
Critical 9.8
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects AC2100 before 1.…
-
Critical 9.4
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1.2.0.…
-
Critical 9.8
SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise …
KEV Nov 3, 2021 -
Critical 9.8
Prototype pollution vulnerability in 'predefine'
Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
flattenizer vulnerable to prototype pollution
Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
shvl vulnerable to prototype pollution
Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution vulnerability in 'libnested'
Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in getobject
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in set-object-value
Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution vulnerability in 'deep-set'
Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
dset vulnerable to prototype pollution
Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.3
Critical security issues in XML encoding in Dex
Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML …
-
Critical 10.0
Template Injection in BrowserUp Proxy
BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Serv…