Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
442 results · page 3 of 9
Mar 29, 2022Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.CVE-2022-1032 · Other software · crater-invoice · reported by security@huntr.devHigh 7.2
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.CVE-2022-1033 · Other software · crater-invoice · reported by security@huntr.devHigh 7.8
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.CVE-2022-0515 · Other software · crater-invoice · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.CVE-2022-0514 · Other software · crater-invoice · reported by security@huntr.devMedium 6.5
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability.CVE-2022-22262 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 7.7
ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic link to system file path, to delete arbitrary system files and disrupt system service.
- Product
- Armoury Crate & Aura Creator Installer (ROG Live Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 27, 2022Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.CVE-2022-0372 · Other software · crater-invoice · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.CVE-2022-0203 · Other software · crater-invoice · reported by security@huntr.devMedium 5.3
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.CVE-2022-0242 · Other software · crater-invoice · reported by security@huntr.devHigh 7.2
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022crater is vulnerable to Unrestricted Upload of File with Dangerous TypeCVE-2021-4080 · Other software · crater-invoice · reported by security@huntr.devHigh 8.8
crater is vulnerable to Unrestricted Upload of File with Dangerous Type
- Product
- crater-invoice/crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2021An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust.CVE-2021-45711 · Other software · Simple Asn1 Project · reported by MITREHigh 7.5
An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
- Product
- Simple Asn1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust.CVE-2021-45710 · Other software · Tokio · reported by MITREHigh 8.1
An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.
- Product
- Tokio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the crypto2 crate through 2021-10-08 for Rust.CVE-2021-45709 · Other software · Crypto2 Project · reported by MITRECritical 9.8
An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur.
- Product
- Crypto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the abomonation crate through 2021-10-17 for Rust.CVE-2021-45708 · Other software · Abomonation Project · reported by MITREHigh 7.5
An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
- Product
- Abomonation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust.CVE-2021-45707 · Other software · NIX Project · reported by MITRECritical 9.8
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
- Product
- NIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Dec 26, 2021An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust.CVE-2021-45706 · Other software · Zeroize Derive Project · reported by MITRECritical 9.8
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
- Product
- Zeroize Derive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the nanorand crate before 0.6.1 for Rust.CVE-2021-45705 · Other software · Nanorand Project · reported by MITRECritical 9.8
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
- Product
- Nanorand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the metrics-util crate before 0.7.0 for Rust.CVE-2021-45704 · Other software · Metrics-util Project · reported by MITREHigh 8.1
An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.
- Product
- Metrics-util
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust.CVE-2021-45703 · Other software · Tectonic XDV Project · reported by MITRECritical 9.8
An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.
- Product
- Tectonic XDV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the tremor-script crate before 0.11.6 for Rust.CVE-2021-45702 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free.
- Product
- Tremor-script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the tremor-script crate before 0.11.6 for Rust.CVE-2021-45701 · Computers, phones & browsers · Linuxfoundation · reported by MITRECritical 9.8
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.
- Product
- Tremor-script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the ckb crate before 0.40.0 for Rust.CVE-2021-45700 · Other software · Nervos · reported by MITREHigh 7.5
An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.
- Product
- CKB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the ckb crate before 0.40.0 for Rust.CVE-2021-45699 · Other software · Nervos · reported by MITREHigh 7.5
An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
- Product
- CKB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the ckb crate before 0.40.0 for Rust.CVE-2021-45698 · Other software · Nervos · reported by MITRECritical 9.8
An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
- Product
- CKB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the molecule crate before 0.7.2 for Rust.CVE-2021-45697 · Other software · Nervos · reported by MITRECritical 9.8
An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
- Product
- Molecule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust.CVE-2021-45696 · Other software · Sha2 Project · reported by MITRECritical 9.8
An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used.
- Product
- Sha2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the mopa crate through 2021-06-01 for Rust.CVE-2021-45695 · Other software · Mopa Project · reported by MITRECritical 9.8
An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
- Product
- Mopa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the rdiff crate through 2021-02-03 for Rust.CVE-2021-45694 · Other software · Rdiff Project · reported by MITREHigh 7.5
An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations.
- Product
- Rdiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust.CVE-2021-45693 · Other software · Messagepack-rs Project · reported by MITRECritical 9.8
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations.
- Product
- Messagepack-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust.CVE-2021-45692 · Other software · Messagepack-rs Project · reported by MITRECritical 9.8
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.
- Product
- Messagepack-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust.CVE-2021-45691 · Other software · Messagepack-rs Project · reported by MITRECritical 9.8
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.
- Product
- Messagepack-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust.CVE-2021-45690 · Other software · Messagepack-rs Project · reported by MITRECritical 9.8
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
- Product
- Messagepack-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust.CVE-2021-45689 · Other software · Gfx-auxil Project · reported by MITRECritical 9.8
An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.
- Product
- Gfx-auxil
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the ash crate before 0.33.1 for Rust.CVE-2021-45688 · Other software · Ash-rs · reported by MITRECritical 9.8
An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.
- Product
- ASH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust.CVE-2021-45687 · Other software · Raw-cpuid Project · reported by MITRECritical 9.8
An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.
- Product
- Raw-cpuid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust.CVE-2021-45686 · Other software · Csv-sniffer Project · reported by MITRECritical 9.8
An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.
- Product
- Csv-sniffer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the columnar crate through 2021-01-07 for Rust.CVE-2021-45685 · Other software · Columnar Project · reported by MITRECritical 9.8
An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.
- Product
- Columnar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the flumedb crate through 2021-01-07 for Rust.CVE-2021-45684 · Other software · Flumedb Project · reported by MITRECritical 9.8
An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations.
- Product
- Flumedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the binjs_io crate through 2021-01-03 for Rust.CVE-2021-45683 · Other software · Binjs IO Project · reported by MITRECritical 9.8
An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
- Product
- Binjs IO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust.CVE-2021-45682 · Other software · Bronzedb-protocol Project · reported by MITRECritical 9.8
An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.
- Product
- Bronzedb-protocol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust.CVE-2021-45681 · Other software · Derive-com-impl Project · reported by MITREHigh 7.5
An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be called before returning a pointer.
- Product
- Derive-com-impl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the vec-const crate before 2.0.0 for Rust.CVE-2021-45680 · Other software · Vec-const Project · reported by MITREHigh 7.5
An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption.
- Product
- Vec-const
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the acc_reader crate through 2020-12-27 for Rust.CVE-2020-36514 · Other software · ACC Reader Project · reported by MITRECritical 9.8
An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations.
- Product
- ACC Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the acc_reader crate through 2020-12-27 for Rust.CVE-2020-36513 · Other software · ACC Reader Project · reported by MITRECritical 9.8
An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
- Product
- ACC Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the buffoon crate through 2020-12-31 for Rust.CVE-2020-36512 · Other software · Buffoon Project · reported by MITRECritical 9.8
An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations.
- Product
- Buffoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the bite crate through 2020-12-31 for Rust.CVE-2020-36511 · Other software · Bite Project · reported by MITREHigh 7.5
An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.
- Product
- Bite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust.CVE-2019-25055 · Other software · Libpulse-binding Project · reported by MITREHigh 7.5
An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
- Product
- Libpulse-binding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the pnet crate before 0.27.2 for Rust.CVE-2019-25054 · Other software · Pnet Project · reported by MITREHigh 7.5
An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
- Product
- Pnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust.CVE-2018-25028 · Other software · Libpulse-binding Project · reported by MITREHigh 7.5
An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_context can cause a use-after-free.
- Product
- Libpulse-binding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust.CVE-2018-25027 · Other software · Libpulse-binding Project · reported by MITREHigh 7.5
An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.
- Product
- Libpulse-binding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 26, 2021An issue was discovered in the actix-web crate before 0.7.15 for Rust.CVE-2018-25026 · Other software · Actix · reported by MITRECritical 9.8
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
- Product
- Actix-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.