Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
442 results · page 7 of 9
Dec 31, 2020An issue was discovered in the ws crate through 2020-09-25 for Rust.CVE-2020-35896 · Other software · Ws-rs Project · reported by MITREHigh 7.5
An issue was discovered in the ws crate through 2020-09-25 for Rust. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack.
- Product
- Ws-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the stack crate before 0.3.1 for Rust.CVE-2020-35895 · Other software · Stack Project · reported by MITRECritical 9.8
An issue was discovered in the stack crate before 0.3.1 for Rust. ArrayVec has an out-of-bounds write via element insertion.
- Product
- Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the obstack crate before 0.1.4 for Rust.CVE-2020-35894 · Other software · Obstack Project · reported by MITREHigh 7.5
An issue was discovered in the obstack crate before 0.1.4 for Rust. Unaligned references can occur.
- Product
- Obstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the simple-slab crate before 0.3.3 for Rust.CVE-2020-35893 · Other software · Simple-slab Project · reported by MITREHigh 7.5
An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized memory.
- Product
- Simple-slab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the simple-slab crate before 0.3.3 for Rust.CVE-2020-35892 · Other software · Simple-slab Project · reported by MITRECritical 9.1
An issue was discovered in the simple-slab crate before 0.3.3 for Rust. index() allows an out-of-bounds read.
- Product
- Simple-slab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the ordnung crate through 2020-09-03 for Rust.CVE-2020-35891 · Other software · Ordnung Project · reported by MITREHigh 7.5
An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via a remove() double free.
- Product
- Ordnung
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the ordnung crate through 2020-09-03 for Rust.CVE-2020-35890 · Other software · Ordnung Project · reported by MITREHigh 7.5
An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via out-of-bounds access for large capacity.
- Product
- Ordnung
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the crayon crate through 2020-08-31 for Rust.CVE-2020-35889 · Other software · Crayon Project · reported by MITREHigh 8.1
An issue was discovered in the crayon crate through 2020-08-31 for Rust. A TOCTOU issue has a resultant memory safety violation via HandleLike.
- Product
- Crayon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the arr crate through 2020-08-25 for Rust.CVE-2020-35888 · Other software · ARR Project · reported by MITRECritical 9.8
An issue was discovered in the arr crate through 2020-08-25 for Rust. Uninitialized memory is dropped by Array::new_from_template.
- Product
- ARR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the arr crate through 2020-08-25 for Rust.CVE-2020-35887 · Other software · ARR Project · reported by MITRECritical 9.8
An issue was discovered in the arr crate through 2020-08-25 for Rust. There is a buffer overflow in Index and IndexMut.
- Product
- ARR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the arr crate through 2020-08-25 for Rust.CVE-2020-35886 · Other software · ARR Project · reported by MITREMedium 4.7
An issue was discovered in the arr crate through 2020-08-25 for Rust. An attacker can smuggle non-Sync/Send types across a thread boundary to cause a data race.
- Product
- ARR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust.CVE-2020-35885 · Other software · Alpm-rs Project · reported by MITRECritical 9.8
An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. StrcCtx performs improper memory deallocation.
- Product
- Alpm-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the tiny_http crate through 2020-06-16 for Rust.CVE-2020-35884 · Other software · Tiny-http Project · reported by MITREMedium 6.5
An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header.
- Product
- Tiny-http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Dec 31, 2020An issue was discovered in the mozwire crate through 2020-08-18 for Rust.CVE-2020-35883 · Other software · Mozwire Project · reported by MITRECritical 9.1
An issue was discovered in the mozwire crate through 2020-08-18 for Rust. A ../ directory-traversal situation allows overwriting local files that have .conf at the end of the filename.
- Product
- Mozwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the rocket crate before 0.4.5 for Rust.CVE-2020-35882 · Other software · Rocket · reported by MITREHigh 8.1
An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.
- Product
- Rocket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the traitobject crate through 2020-06-01 for Rust.CVE-2020-35881 · Other software · Traitobject Project · reported by MITRECritical 9.8
An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers, possibly causing memory corruption in, for example, Rust 2.x.
- Product
- Traitobject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the bigint crate through 2020-05-07 for Rust.CVE-2020-35880 · Other software · Bigint Project · reported by MITRECritical 9.8
An issue was discovered in the bigint crate through 2020-05-07 for Rust. It allows a soundness violation.
- Product
- Bigint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the rulinalg crate through 2020-02-11 for Rust.CVE-2020-35879 · Other software · Rulinalg Project · reported by MITRECritical 9.8
An issue was discovered in the rulinalg crate through 2020-02-11 for Rust. There are incorrect lifetime-boundary definitions for RowMut::raw_slice and RowMut::raw_slice_mut.
- Product
- Rulinalg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the ozone crate through 2020-07-04 for Rust.CVE-2020-35878 · Other software · Ozone Project · reported by MITRECritical 9.8
An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of the dropping of uninitialized memory.
- Product
- Ozone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the ozone crate through 2020-07-04 for Rust.CVE-2020-35877 · Other software · Ozone Project · reported by MITRECritical 9.8
An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of out-of-bounds access.
- Product
- Ozone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the rio crate through 2020-05-11 for Rust.CVE-2020-35876 · Other software · RIO Project · reported by MITRECritical 9.8
An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race.
- Product
- RIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust.CVE-2020-35875 · Other software · Tokio · reported by MITREHigh 7.5
An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly.
- Product
- Tokio-rustls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the internment crate through 2020-05-28 for Rust.CVE-2020-35874 · Other software · Internment Project · reported by MITREHigh 8.1
An issue was discovered in the internment crate through 2020-05-28 for Rust. ArcIntern::drop has a race condition and resultant use-after-free.
- Product
- Internment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the rusqlite crate before 0.23.0 for Rust.CVE-2020-35873 · Other software · Rusqlite Project · reported by MITRECritical 9.8
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free.
- Product
- Rusqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the rusqlite crate before 0.23.0 for Rust.CVE-2020-35872 · Other software · Rusqlite Project · reported by MITRECritical 9.8
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type.
- Product
- Rusqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the rusqlite crate before 0.23.0 for Rust.CVE-2020-35871 · Other software · Rusqlite Project · reported by MITREHigh 8.1
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.
- Product
- Rusqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the rusqlite crate before 0.23.0 for Rust.CVE-2020-35870 · Other software · Rusqlite Project · reported by MITRECritical 9.8
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.
- Product
- Rusqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the rusqlite crate before 0.23.0 for Rust.CVE-2020-35869 · Other software · Rusqlite Project · reported by MITRECritical 9.8
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.
- Product
- Rusqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the rusqlite crate before 0.23.0 for Rust.CVE-2020-35868 · Other software · Rusqlite Project · reported by MITRECritical 9.8
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification.
- Product
- Rusqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the rusqlite crate before 0.23.0 for Rust.CVE-2020-35867 · Other software · Rusqlite Project · reported by MITRECritical 9.8
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.
- Product
- Rusqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the rusqlite crate before 0.23.0 for Rust.CVE-2020-35866 · Other software · Rusqlite Project · reported by MITRECritical 9.8
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor.
- Product
- Rusqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the os_str_bytes crate before 2.0.0 for Rust.CVE-2020-35865 · Other software · OS STR Bytes Project · reported by MITREHigh 7.5
An issue was discovered in the os_str_bytes crate before 2.0.0 for Rust. It has false expectations about char::from_u32_unchecked behavior.
- Product
- OS STR Bytes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust.CVE-2020-35864 · Computers, phones & browsers · Google · reported by MITREHigh 7.5
An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.
- Product
- Flatbuffers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the hyper crate before 0.12.34 for Rust.CVE-2020-35863 · Other software · Hyper · reported by MITRECritical 9.8
An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.
- Product
- Hyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the bitvec crate before 0.17.4 for Rust.CVE-2020-35862 · Other software · Bitvec Project · reported by MITRECritical 9.8
An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free.
- Product
- Bitvec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the bumpalo crate before 3.2.1 for Rust.CVE-2020-35861 · Other software · Bumpalo Project · reported by MITREHigh 7.5
An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.
- Product
- Bumpalo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the cbox crate through 2020-03-19 for Rust.CVE-2020-35860 · Other software · Cbox Project · reported by MITRECritical 9.8
An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code.
- Product
- Cbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust.CVE-2020-35859 · Other software · Lucet-runtime-internals Project · reported by MITRECritical 9.1
An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust. It mishandles sigstack allocation. Guest programs may be able to obtain sensitive information, or guest programs can experience memory corruption.
- Product
- Lucet-runtime-internals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the prost crate before 0.6.1 for Rust.CVE-2020-35858 · Other software · Prost Project · reported by MITRECritical 9.8
An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message, causing a denial of service (e.g., x86) or possibly remote code execution (e.g., ARM).
- Product
- Prost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust.CVE-2020-35857 · Other software · Trust-dns-server Project · reported by MITREHigh 7.5
An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption.
- Product
- Trust-dns-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the failure crate through 2019-11-13 for Rust.CVE-2019-25010 · Other software · Failure Project · reported by MITRECritical 9.8
An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.
- Product
- Failure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the http crate before 0.1.20 for Rust.CVE-2019-25009 · Other software · Hyper · reported by MITRECritical 9.8
An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.
- Product
- Http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the streebog crate before 0.8.0 for Rust.CVE-2019-25007 · Other software · Streebog Project · reported by MITREHigh 7.5
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic.
- Product
- Streebog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the streebog crate before 0.8.0 for Rust.CVE-2019-25006 · Other software · Streebog Project · reported by MITREHigh 7.5
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
- Product
- Streebog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the chacha20 crate before 0.2.3 for Rust.CVE-2019-25005 · Other software · Chacha20 Project · reported by MITREHigh 7.5
An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.
- Product
- Chacha20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the flatbuffers crate before 0.6.1 for Rust.CVE-2019-25004 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness.
- Product
- Flatbuffers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust.CVE-2019-25003 · Other software · Parity · reported by MITREHigh 7.5
An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers can obtain sensitive information.
- Product
- Libsecp256k1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust.CVE-2019-25002 · Other software · Sodiumoxide Project · reported by MITRECritical 9.8
An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties.
- Product
- Sodiumoxide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the serde_cbor crate before 0.10.2 for Rust.CVE-2019-25001 · Other software · Serde Cbor Project · reported by MITREHigh 7.5
An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags.
- Product
- Serde Cbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust.CVE-2018-25001 · Other software · Libpulse-binding Project · reported by MITREMedium 6.5
An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.
- Product
- Libpulse-binding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.