Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
Medium 5.9
Race condition in tokio
An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.
-
High 7.5
Overflow in prost-types
An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime.
-
Medium 6.1
Cross-site Scripting in ammonia
An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
-
Critical 9.8
Calculation error in ark-r1cs-std
An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mul_by_inverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified.
-
Critical 9.8
Overflow in libsecp256k1
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
-
Critical 9.8
Remote code execution in better-macro
An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose.
-
Critical 9.8
Data race in crossbeam-deque
crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of oth…
-
Medium 4.2
MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application
Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these event…
-
High 7.8
Uncontrolled Search Path Element in sharkdp/bat
sharkdp BAT before 0.18.2 executes less.exe from the current working directory.
-
High 7.8
Relative Path Traversal in git-delta
dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.
-
Low 3.1
Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP p…
-
Medium 5.9
Integer Overflow in Chunked Transfer-Encoding
hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream …
-
Critical 9.8
OS command injection in ripgrep
ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.
-
Critical 9.8
Static imports inside dynamically imported modules do not adhere to permission checks
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission che…
-
High 7.8
Permissions bypass in pleaser
Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.
-
High 7.8
Permissions bypass in pleaser
pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.
-
Low 3.3
File exposure in pleaser
please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.
-
High 7.2
Memory access due to code generation flaw in Cranelift module
Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could …
-
Unscored —
Crate `twoway` deprecated by the author
The commit [`e99b3c7`](https://github.com/bluss/twoway/commit/e99b3c718df1117ad7f54c33f6540c8f46cc17dd) releasing version 0.2.2 explicitly deprecates `twoway` in favour of [`memchr`](https://crates.io/crates/memchr) crate.
-
Medium 6.5
Memory over-allocation in evm crate
evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the `evm` crate can over-allocate memory when it is not needed, making…
-
Unscored —
`cpuid-bool` has been renamed to `cpufeatures`
Please use the `cpufeatures`` crate going forward: <https://github.com/RustCrypto/utils/tree/master/cpufeatures> There will be no further releases of `cpuid-bool`.
-
High 7.5
Double free in algorithmica
An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in merge_sort::merge().
-
High 7.5
Use of uninitialized buffer in rkyv
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.
-
Unscored —
`aes-ctr` has been merged into the `aes` crate
Please use the `aes` crate going forward. The new repository location is at: <https://github.com/RustCrypto/block-ciphers/tree/master/aes> The `aes` crate now has an optional `ctr` feature which autodetects SIMD features on `i686`/`x86-64` targets and uses th…
-
Unscored —
`aes-soft` has been merged into the `aes` crate
Please use the `aes` crate going forward. The new repository location is at: <https://github.com/RustCrypto/block-ciphers/tree/master/aes> AES-NI is now autodetected at runtime on `i686`/`x86-64` platforms. If AES-NI is not present, the `aes` crate will fallb…
-
Unscored —
`aesni` has been merged into the `aes` crate
Please use the `aes` crate going forward. The new repository location is at: <https://github.com/RustCrypto/block-ciphers/tree/master/aes> AES-NI is now autodetected at runtime on `i686`/`x86-64` platforms. If AES-NI is not present, the `aes` crate will fallb…
-
Critical 9.8
Uninitialized memory access in outer_cgi
An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
-
Critical 9.8
Double-free in id-map
An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in IdMap::clone_from upon a .clone panic.
-
Unscored —
`sass-rs` has been deprecated
The `sass-rs` crate is not maintained anymore as libsass is deprecated. Consider using https://github.com/connorskees/grass or https://github.com/kaj/rsass instead. (Author's recommendation.)
-
Unscored —
rusttype is Unmaintained
The maintainer has advised this crate is deprecated and will not receive any maintenance. The maintainer has further advised to migrate over to `ab_glyph`. Last release seems to have been over two years ago. ## Possible Alternative(s) The below list has not b…
-
High 7.5
Double free in endian_trait
An issue was discovered in the endian_trait crate through 2021-01-04 for Rust. A double drop can occur when a user-provided Endian impl panics.
-
High 7.5
Out of bounds write in arenavec
An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A drop of uninitialized memory can sometimes occur upon a panic in T::default().
-
High 7.5
Uncontrolled Resource Consumption in parse_duration
An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.
-
High 7.5
Double free in insert_many
An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics.
-
High 7.3
Out of bounds read in uu_od
An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.
-
High 7.3
Use after free in Rocket
An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
-
Critical 9.8
Free of uninitialized memory in adtensor
An issue was discovered in the adtensor crate through 2021-01-11 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vector and Matrix.
-
Critical 9.8
Free of uninitialized memory in telemetry
An issue was discovered in the telemetry crate through 2021-02-17 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size().
-
High 7.5
Double free in slice-deque
An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function.
-
High 7.3
Out of bounds write in stackvector
An issue was discovered in the stackvector crate through 2021-02-19 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain anomalous data.