Archive
18 February 2021
Vulnerabilities first published on this day (UTC), newest first.
4 results · Clear filters · Feed
-
Critical 9.1
Command Injection
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')
-
Critical 9.8
nb-connect invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
-
Critical 9.8
Use-after-free in yottadb
An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.
-
Critical 9.8
Incorrect check on buffer length in rand_core
An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data.