Archive
1 April 2021
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
High 8.1
ApiKey secret could be revelated on network issue
node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
-
High 7.5
Vulnerability in Stripe for Visual Studio Code < 1.7.3
vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability c…
-
High 8.6
Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system
-
High 7.5
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
-
High 8.1
Acrobat Reader DC Missing Support for Integrity Check
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker would have the ability to completely manipulate data in a c…
-
High 7.2
Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Ma…
-
High 7.5
Double free in endian_trait
An issue was discovered in the endian_trait crate through 2021-01-04 for Rust. A double drop can occur when a user-provided Endian impl panics.
-
High 7.5
Out of bounds write in arenavec
An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A drop of uninitialized memory can sometimes occur upon a panic in T::default().
-
High 7.5
Uncontrolled Resource Consumption in parse_duration
An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.
-
High 7.5
Double free in insert_many
An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics.
-
High 7.3
Out of bounds read in uu_od
An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.
-
High 7.3
Use after free in Rocket
An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
-
High 7.5
Double free in slice-deque
An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function.
-
High 7.3
Out of bounds write in stackvector
An issue was discovered in the stackvector crate through 2021-02-19 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain anomalous data.
-
High 7.3
Out of bounds write in reorder
An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too small.
-
High 7.5
Improper Restriction of XML External Entity Reference in pikepdf
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.