Archive
December 2021
Vulnerabilities first published in this month (UTC), newest first.
166 results · Clear filters · Feed
-
Critical 9.8
Dnsmasq 2.86 has a heap-based buffer overflow in print_mac (called from log_packet and dhcp_reply). NOTE: the vendor's …
-
Critical 9.8
ICSA-21-357-01 Moxa MGate Protocol Gateways
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.
-
Critical 9.8
Gerapy may contain remote code execution vulnerability
Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.
-
Critical 9.8
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
-
Critical 9.8
InputStream::read_exact : `Read` on uninitialized buffer causes UB
An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in acc_reader.
An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
-
Critical 9.8
`Read` on uninitialized buffer can cause UB (impl of `ReadKVExt`)
An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.
-
Critical 9.8
'Read' on uninitialized memory may cause UB
An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in flumedb.
An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations.
-
Critical 9.8
columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())
An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.
-
Critical 9.8
Optional `Deserialize` implementations lacking validation
An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.
-
Critical 9.8
Use of Uninitialized Resource in ash.
An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.
-
Critical 9.8
Reading on uninitialized buffer may cause UB ( `gfx_auxil::read_spirv()` )
An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in messagepack-rs.
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
-
Critical 9.8
Incorrect reliance on Trait memory layout in mopa
An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
-
Critical 9.8
Incorrect hash in sha2
An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used.
-
Critical 9.8
The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.
An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
-
Critical 9.8
RPC call failure in ckb
An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
-
Critical 9.8
Use of Uninitialized Resource in tectonic_xdv
An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.
-
Critical 9.8
Aliased mutable references from `tls_rand` & `TlsWyRand`
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
-
Critical 9.8
Memory flaw in zeroize_derive
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
-
Critical 9.8
Use of a Broken or Risky Cryptographic Algorithm in crypto2
An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur.
-
Critical 9.8
Use of Uninitialized Resource in csv-sniffer.
An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.
-
Critical 9.1
NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
-
Critical 9.4
NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects R7000P before 1.3.3.140 and R8000 before 1.…
-
Critical 9.4
Certain NETGEAR devices are affected by authentication bypass. This affects AC2400 before 1.1.0.84, AC2600 before 1.1.0…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR750 before 4.6.3.6, RBK752 before 3.2.17…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.…
-
Critical 9.6
Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, RBK752 before 3.2.17…
-
Critical 9.6
NETGEAR XR1000 devices before 1.0.0.58 are affected by command injection by an unauthenticated attacker.
-
Critical 9.6
NETGEAR XR1000 devices before 1.0.0.58 are affected by command injection by an unauthenticated attacker.
-
Critical 9.6
Certain NETGEAR devices are affected by a hardcoded password. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.…
-
Critical 9.6
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D6220 before 1.0.0.68,…
-
Critical 9.6
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D8500 before 1.0…