Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
442 results · page 9 of 9
Sep 9, 2019An issue was discovered in the generator crate before 0.6.18 for Rust.CVE-2019-16144 · Other software · Generator-rs Project · reported by MITREHigh 7.5
An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls.
- Product
- Generator-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2019An issue was discovered in the blake2 crate before 0.8.1 for Rust.CVE-2019-16143 · Other software · Blake2 · reported by MITRECritical 9.8
An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes.
- Product
- Blake2-rust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Sep 9, 2019An issue was discovered in the renderdoc crate before 0.5.0 for Rust.CVE-2019-16142 · Other software · Renderdocs-rs Project · reported by MITRECritical 9.8
An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application.
- Product
- Renderdocs-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2019An issue was discovered in the once_cell crate before 1.0.1 for Rust.CVE-2019-16141 · Other software · Once Cell Project · reported by MITREHigh 7.5
An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy.
- Product
- Once Cell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2019An issue was discovered in the chttp crate before 0.1.3 for Rust.CVE-2019-16140 · Other software · Isahc Project · reported by MITRECritical 9.8
An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.
- Product
- Isahc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2019An issue was discovered in the compact_arena crate before 0.4.0 for Rust.CVE-2019-16139 · Other software · Compact Arena Project · reported by MITRECritical 9.8
An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or read.
- Product
- Compact Arena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2019An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder.CVE-2019-16138 · Other software · Image-rs · reported by MITRECritical 9.8
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
- Product
- Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2019An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used.CVE-2019-16137 · Other software · Spin-rs Project · reported by MITREHigh 7.5
An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion.
- Product
- Spin-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the ncurses crate through 5.99.0 for Rust.CVE-2019-15548 · Other software · Ncurses Project · reported by MITRECritical 9.8
An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.
- Product
- Ncurses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the ncurses crate through 5.99.0 for Rust.CVE-2019-15547 · Other software · Ncurses Project · reported by MITREHigh 7.5
An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format arguments are mishandled.
- Product
- Ncurses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the pancurses crate through 0.16.1 for Rust.CVE-2019-15546 · Other software · Pancurses Project · reported by MITREHigh 7.5
An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities.
- Product
- Pancurses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the libp2p-core crate before 0.8.1 for Rust.CVE-2019-15545 · Other software · Libp2p · reported by MITREHigh 7.5
An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.
- Product
- Libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the protobuf crate before 2.6.0 for Rust.CVE-2019-15544 · Other software · Rust-protobuf Project · reported by MITREHigh 7.5
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
- Product
- Rust-protobuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Aug 26, 2019An issue was discovered in the slice-deque crate before 0.2.0 for Rust.CVE-2019-15543 · Other software · Slice-deque Project · reported by MITRECritical 9.8
An issue was discovered in the slice-deque crate before 0.2.0 for Rust. There is memory corruption in certain allocation cases.
- Product
- Slice-deque
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the ammonia crate before 2.1.0 for Rust.CVE-2019-15542 · Other software · Ammonia Project · reported by MITREHigh 7.5
An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
- Product
- Ammonia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the arrayfire crate before 3.6.0 for Rust.CVE-2018-20998 · Other software · Arrayfire · reported by MITRECritical 9.8
An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled, leading to memory corruption.
- Product
- Arrayfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the openssl crate before 0.10.9 for Rust.CVE-2018-20997 · Other software · Rust-openssl Project · reported by MITRECritical 9.8
An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.
- Product
- Rust-openssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the crossbeam crate before 0.4.1 for Rust.CVE-2018-20996 · Other software · Crossbeam Project · reported by MITRECritical 9.8
An issue was discovered in the crossbeam crate before 0.4.1 for Rust. There is a double free because of destructor mishandling.
- Product
- Crossbeam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the slice-deque crate before 0.1.16 for Rust.CVE-2018-20995 · Other software · Slice-deque Project · reported by MITRECritical 9.8
An issue was discovered in the slice-deque crate before 0.1.16 for Rust. move_head_unchecked allows memory corruption because deque updates are mishandled.
- Product
- Slice-deque
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the untrusted crate before 0.6.2 for Rust.CVE-2018-20989 · Other software · Untrusted Project · reported by MITREHigh 7.5
An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
- Product
- Untrusted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the cookie crate before 0.7.6 for Rust.CVE-2017-18589 · Other software · Cookie Project · reported by MITREHigh 7.5
An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
- Product
- Cookie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the security-framework crate before 0.1.12 for Rust.CVE-2017-18588 · Other software · Security-framework Project · reported by MITREMedium 5.3
An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.
- Product
- Security-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the asn1_der crate before 0.6.2 for Rust.CVE-2019-15549 · Other software · Asn1 DER Project · reported by MITREHigh 7.5
An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a length field.
- Product
- Asn1 DER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the smallvec crate before 0.6.10 for Rust.CVE-2019-15554 · Other software · Servo · reported by MITRECritical 9.8
An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.
- Product
- Smallvec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019An issue was discovered in the memoffset crate before 0.5.0 for Rust.CVE-2019-15553 · Other software · Memoffset Project · reported by MITREHigh 7.5
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
- Product
- Memoffset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019An issue was discovered in the libflate crate before 0.1.25 for Rust.CVE-2019-15552 · Other software · Libflate Project · reported by MITRECritical 9.8
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
- Product
- Libflate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019An issue was discovered in the smallvec crate before 0.6.10 for Rust.CVE-2019-15551 · Other software · Servo · reported by MITRECritical 9.8
An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity.
- Product
- Smallvec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019An issue was discovered in the simd-json crate before 0.1.15 for Rust.CVE-2019-15550 · Other software · Simdjson Project · reported by MITREHigh 7.5
An issue was discovered in the simd-json crate before 0.1.15 for Rust. There is an out-of-bounds read and an incorrect crossing of a page boundary.
- Product
- Simdjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the safe-transmute crate before 0.10.1 for Rust.CVE-2018-21000 · Other software · Safe-transmute Project · reported by MITRECritical 9.8
An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order, causing heap memory corruption.
- Product
- Safe-transmute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019An issue was discovered in the orion crate before 0.11.2 for Rust.CVE-2018-20999 · Other software · Orion Project · reported by MITREHigh 7.5
An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.
- Product
- Orion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019An issue was discovered in the smallvec crate before 0.6.3 for Rust.CVE-2018-20991 · Other software · Servo · reported by MITRECritical 9.8
An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.
- Product
- Smallvec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust.CVE-2018-20994 · Other software · Trust-dns-proto Project · reported by MITREHigh 7.5
An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.
- Product
- Trust-dns-proto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the yaml-rust crate before 0.4.1 for Rust.CVE-2018-20993 · Other software · Yaml-rust Project · reported by MITREHigh 7.5
An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.
- Product
- Yaml-rust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the claxon crate before 0.4.1 for Rust.CVE-2018-20992 · Other software · Claxon Project · reported by MITREMedium 6.5
An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled.
- Product
- Claxon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the tar crate before 0.4.16 for Rust.CVE-2018-20990 · Other software · TAR Project · reported by MITREHigh 7.5
An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive.
- Product
- TAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the hyper crate before 0.9.18 for Rust.CVE-2017-18587 · Other software · Hyper · reported by MITREMedium 5.3
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
- Product
- Hyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the portaudio crate through 0.7.0 for Rust.CVE-2016-10933 · Other software · Portaudio Project · reported by MITREMedium 5.9
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
- Product
- Portaudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows.CVE-2016-10932 · Other software · Hyper · reported by MITREMedium 4.8
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
- Product
- Hyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Aug 26, 2019rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arraCVE-2019-15541 · Other software · Rustls Project · reported by MITREHigh 7.5
rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.
- Product
- Rustls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019An issue was discovered in the openssl crate before 0.9.0 for Rust.CVE-2016-10931 · Other software · Rust-openssl Project · reported by MITREHigh 8.1
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
- Product
- Rust-openssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Jun 12, 2006Multiple SQL injection vulnerabilities in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) iCVE-2006-2987 · Other software · Dominios Europa · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) voteid, and (3) vfiel parameters to (a) index.php, and via the (4) nick, (5) email, (6) city, (7) messen, and (8) message form field parameters to (b) add.php. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
- Product
- Picrate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2006Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to inject arbitrary wCVE-2006-2812 · Other software · Dominios Europa · reported by MITREMedium 6.8
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the (1) name (aka nick), (2) email, and (3) comment boxes; and via the (4) id parameter.
- Product
- Picrate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.