Archive
5 March 2021
Vulnerabilities first published on this day (UTC), newest first.
61 results · Feed
-
Unscored —
Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading t…
-
Critical 9.8
Loading a bgzip block can write out of bounds if size overflows.
An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
-
Critical 9.8
Double free in toodee
An issue was discovered in the toodee crate before 0.3.0 for Rust. Row insertion can cause a double free upon an iterator panic.
-
High 7.5
Use of Uninitialized Resource in truetype
An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.
-
Critical 9.8
move_elements can double-free objects on panic
An issue was discovered in the scratchpad crate before 1.3.1 for Rust. The move_elements function can have a double-free upon a panic in a user-provided f function.
-
Critical 9.8
Use after free in nano_arena
An issue was discovered in the nano_arena crate before 0.5.2 for Rust. There is an aliasing violation in split_at because two mutable references can exist for the same element, if Borrow<Idx> behaves in certain ways. This can have a resultant out-of-bounds wr…
-
Critical 9.8
Drop of uninitialized memory in stack_dst
An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a double free can occur upon a val.clone() panic.
-
Unscored —
An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a drop of uni…
-
High 7.5
quinn invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
-
Critical 9.8
Data race in internment
An issue was discovered in the internment crate before 0.4.2 for Rust. There is a data race that can cause memory corruption because of the unconditional implementation of Sync for Intern<T>.
-
Critical 9.8
Deserializing an array can free uninitialized memory in byte_struct
An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.
-
Unscored —
An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read t…
-
High 7.1
Rancher: XSS on /v3/cluster/
A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6.
-
Medium 5.3
Activerecord-session_store Vulnerable to Timing Attack
The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can levera…
-
Unscored —CVE-2020-5148 Public exploit
SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing …
-
Unscored —
An issue was discovered in IdentityModel (aka ScottBrady.IdentityModel) before 1.3.0. The Branca implementation allows …
-
Unscored —
The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privile…
-
Unscored —CVE-2021-27963 Public exploit
SonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g., SuperAdmin). An anonymous …
-
Unscored —
SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Co…
-
Unscored —
An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations,…
-
Unscored —
An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver l…