Archive
1 April 2021
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
High 8.1
Acrobat Reader DC Missing Support for Integrity Check
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker would have the ability to completely manipulate data in a c…
-
Critical 9.1
Improper parsing of octal bytes in netmask
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass pack…
-
Unscored —
rusttype is Unmaintained
The maintainer has advised this crate is deprecated and will not receive any maintenance. The maintainer has further advised to migrate over to `ab_glyph`. Last release seems to have been over two years ago. ## Possible Alternative(s) The below list has not b…
-
High 7.2
Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Ma…
-
Unscored —
BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies).…
-
High 7.5
Double free in endian_trait
An issue was discovered in the endian_trait crate through 2021-01-04 for Rust. A double drop can occur when a user-provided Endian impl panics.
-
High 7.5
Out of bounds write in arenavec
An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A drop of uninitialized memory can sometimes occur upon a panic in T::default().
-
Unscored —
An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A double drop can sometimes occur upon a pan…
-
High 7.5
Uncontrolled Resource Consumption in parse_duration
An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.
-
High 7.5
Double free in insert_many
An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics.
-
High 7.3
Out of bounds read in uu_od
An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.
-
High 7.3
Use after free in Rocket
An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
-
Critical 9.8
Free of uninitialized memory in adtensor
An issue was discovered in the adtensor crate through 2021-01-11 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vector and Matrix.
-
Critical 9.8
Free of uninitialized memory in telemetry
An issue was discovered in the telemetry crate through 2021-02-17 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size().
-
High 7.5
Double free in slice-deque
An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function.
-
High 7.3
Out of bounds write in stackvector
An issue was discovered in the stackvector crate through 2021-02-19 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain anomalous data.
-
Critical 9.8
Double free in through
An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
-
High 7.3
Out of bounds write in reorder
An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too small.
-
Unscored —
An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index can return uninitialized values if…
-
Unscored —
The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before versi…
-
Unscored —
The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before versi…
-
Unscored —
The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before ver…
-
High 7.5
Improper Restriction of XML External Entity Reference in pikepdf
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
-
Unscored —
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logge…
-
Unscored —
A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is proces…