Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
Unscored —
`openslide` is unmaintained
The [`openslide`](https://crates.io/crates/openslide) crate is no longer maintained. Last release was on 2018-11-20. ## Possible alternatives Consider using an alternative, for instance: - [openslide-rs](https://crates.io/crates/openslide-rs) - [pamly](https:…
-
Unscored —
`opentelemetry_api` has been merged into the `opentelemetry` crate
Last release was on 2023-07-30. `opentelemetry_api` has been moved into the [`opentelemetry` crate](https://crates.io/crates/opentelemetry). Please use the `opentelemetry` crate going forward.
-
Medium 6.4
Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8…
-
High 7.5
Unlimited number of NTS-KE connections can crash ntpd-rs server
nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. N…
-
Unscored —
`derivative` is unmaintained; consider using an alternative
The [`derivative`](https://crates.io/crates/derivative) crate is no longer maintained. Consider using any alternative, for instance: - [derive_more](https://crates.io/crates/derive_more) - [derive-where](https://crates.io/crates/derive-where) - [educe](https:…
-
Unscored —
The maintainer of chrono-english is unresponsive
All versions will encounter compilation errors with a chrono version `>0.4.35`, due to backward incompatible API changes. User conradludgade reworked the original crate and created a fork with the same API surface called [interim](https://github.com/conradlud…
-
Low 2.9
Symlink bypasses filesystem sandbox in wasmer
Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both `oflags::creat` and `rights::fd…
-
High 7.5
Rhai stack overflow vulenrability
A stack overflow vulnerability was found in version 1.18.0 of rhai. The flaw position is: (/ SRC/rhai/SRC/eval/STMT. Rs in rhai: : eval: : STMT: : _ $LT $impl $u20 $rhai.. engine.. Engine$GT$::eval_stmt::h3f1d68ce37fc6e96). Due to the stack overflow is a recu…
-
Unscored —
mmap unmaintained
The `mmap` crate is unmaintained as its [repository has been archived](https://github.com/rbranson/rust-mmap) on Feb 10, 2022. The main alternative seems to be `memmap2` crate.
-
Low —
s2n-tls has a potentially observable differences in RSA premaster secret handling
When receiving a message from a client that sent an invalid RSA premaster secret, an issue in s2n-tls results in the server performing additional processing when the premaster secret contains an incorrect client hello version. While no practical attack on s2n…
-
Critical 9.4
nano-id is unable to generate the correct character set
nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set…
-
Critical 9.8
Path Traversal in qdrant/qdrant
qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary l…
-
Medium 5.9
iFrames Bypass Origin Checks for Tauri API Access Control
Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities`…
-
Medium 5.4
gix refs and paths with reserved Windows device names access the devices
gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned,…
-
High 8.8
gix traversal outside working tree enables arbitrary code execution
gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This…
-
Medium 5.9
BTreeMap memory leak when deallocating nodes with overflows
When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only the first memory chunk is deallocated, and the rest of the memory chunks remai…
-
Medium 6.2
Tor Arti's STUB circuits incorrectly have a length of 2
In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.
-
Medium 5.5
matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side `key backup` stores encrypted copies of Matrix message keys. This facilitates key sharin…
-
Critical 9.1
Spin contains a potential network sandbox escape for specifically configured Spin applications
Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to ar…
-
High 8.5
Deno contains a permission escalation via open of privileged files with missing `--deny` flag
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/pro…
-
Low 2.5
Degraded secret zeroization capabilities in vodozemac
vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization cap…
-
Critical 9.1
Defect in query plan cache may cause incorrect operations to be executed in Apollo Router
Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operations being executed w…
-
High 7.5
Yamux Memory Exhaustion Vulnerability via Active::pending_frames property
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of …
-
Medium 5.8
Stored Cross-site Scripting in directory listings via file names in static-web-server
Static Web Server (SWS) is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name…
-
Medium 6.4
gix-transport indirect code execution via malicious username
gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syn…
-
Unscored —
The crate `zip_next` has been renamed to `zip`.
Please switch to the new name. `zip_next` will receive no further releases.
-
High 7.5
Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input
Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, t…
-
Unscored —
`rsa-export` is unmaintained
This crate has been deprecated in favour of using the native support for exporting RSA keys into the standard PEM format. See [docs.rs documentation]. In addition to that, the operations in this crate (arithmetic and Base64 encoding) are not done in constant-…
-
Medium 5.9
libdav1d-sys affected by dav1d AV1 decoder integer overflow
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0.
-
High 7.5
crayon: ObjectPool creates uninitialized memory when freeing objects
As of version 0.6.0, the ObjectPool explicitly creates an uninitialized instance of its type parameter when it attempts to free an object, and swaps it into the storage. This causes instant undefined behavior due to reading the uninitialized memory in order t…
-
High 8.2
whoami stack buffer overflow on several Unix platforms
With versions of the whoami crate >= 0.5.3 and < 1.5.0, calling any of these functions leads to an immediate stack buffer overflow on illumos and Solaris: - `whoami::username` - `whoami::realname` - `whoami::username_os` - `whoami::realname_os` With versions …
-
High 7.5
eyre: Parts of Report are dropped as the wrong type during downcast
In affected versions, after a `Report` is constructed using `wrap_err` or `wrap_err_with` to attach a message of type `D` onto an error of type `E`, then using `downcast` to recover ownership of either the value of type `D` or the value of type `E`, one of tw…
-
High 7.5
HPACK decoder panics on invalid input
Due to insufficient checking of input data, decoding certain data sequences can lead to _Decoder::decode_ panicking rather than returning an error. Example code that triggers this vulnerability looks like this: ```rust use hpack::Decoder; pub fn main() { let …
-
Medium 5.3
h2 servers vulnerable to degradation of service with CONTINUATION Flood
An attacker can send a flood of CONTINUATION frames, causing `h2` to process them indefinitely. This results in an increase in CPU usage. Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate req…
-
Unscored —
`libp2p-tokio-socks5` is unmaintained
Note the repository was archived without an issue so we link directly to the commit that marked the repository as unmaintained. To the best of the original authors knowledge the crate has no vulnerabilities as of the last release, it is just unmaintained due …
-
Low 3.3
Wasmtime vulnerable to panic when using a dropped extenref-typed element segment
wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtim…
-
Unscored —
Puccinier is unmainted.
The tool has been deprecated in favor of Catppuccin's new tool, [whiskers](https://github.com/catppuccin/toolbox/tree/main/whiskers) [(crates.io)](https://crates.io/crates/catppuccin-whiskers).
-
Critical 9.8
aliyundrive-webdav vulnerable to Command Injection
An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component.
-
Unscored —
unsafe-libyaml is unmaintained
The [repository](https://github.com/dtolnay/unsafe-libyaml) was archived by its owner on 2024-03-25 and is read-only. The last release is 0.2.11 (March 2024). `unsafe-libyaml` is a machine translation of libyaml's C code into unsafe Rust (c2rust). Bugs found …
-
Unscored —
yaml-rust is unmaintained.
The maintainer seems [unreachable](https://github.com/chyh1990/yaml-rust/issues/197). Many issues and pull requests have been submitted over the years without any [response](https://github.com/chyh1990/yaml-rust/issues/160). ## Alternatives Consider switching…