Archive
26 December 2021
Vulnerabilities first published on this day (UTC), newest first.
66 results · Clear filters · Feed
-
Critical 9.8
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
-
Critical 9.8
InputStream::read_exact : `Read` on uninitialized buffer causes UB
An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in acc_reader.
An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
-
Critical 9.8
`Read` on uninitialized buffer can cause UB (impl of `ReadKVExt`)
An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.
-
Critical 9.8
'Read' on uninitialized memory may cause UB
An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in flumedb.
An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations.
-
Critical 9.8
columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())
An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.
-
Critical 9.8
Optional `Deserialize` implementations lacking validation
An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.
-
Critical 9.8
Use of Uninitialized Resource in ash.
An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.
-
Critical 9.8
Reading on uninitialized buffer may cause UB ( `gfx_auxil::read_spirv()` )
An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in messagepack-rs.
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
-
Critical 9.8
Incorrect reliance on Trait memory layout in mopa
An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
-
Critical 9.8
Incorrect hash in sha2
An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used.
-
Critical 9.8
The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.
An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
-
Critical 9.8
RPC call failure in ckb
An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
-
Critical 9.8
Use of Uninitialized Resource in tectonic_xdv
An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.
-
Critical 9.8
Aliased mutable references from `tls_rand` & `TlsWyRand`
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
-
Critical 9.8
Memory flaw in zeroize_derive
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
-
Critical 9.8
Use of a Broken or Risky Cryptographic Algorithm in crypto2
An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur.
-
Critical 9.8
Use of Uninitialized Resource in csv-sniffer.
An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.
-
Critical 9.1
NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
-
Critical 9.4
NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects R7000P before 1.3.3.140 and R8000 before 1.…
-
Critical 9.4
Certain NETGEAR devices are affected by authentication bypass. This affects AC2400 before 1.1.0.84, AC2600 before 1.1.0…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, RBK752 before 3.2.17…
-
Critical 9.6
NETGEAR XR1000 devices before 1.0.0.58 are affected by command injection by an unauthenticated attacker.
-
Critical 9.6
NETGEAR XR1000 devices before 1.0.0.58 are affected by command injection by an unauthenticated attacker.
-
Critical 9.6
Certain NETGEAR devices are affected by a hardcoded password. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.…
-
Critical 9.6
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D6220 before 1.0.0.68,…
-
Critical 9.6
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D8500 before 1.0…
-
Critical 9.6
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D6220 before 1.0…
-
Critical 9.6
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects DC112A before 1.…
-
Critical 9.6
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5…