deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-38167
Published: 2021-08-07
Description: Roxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can extract a valid uuid to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/hap-wi/roxy-wi/issues/285; https://github.com/hap-wi/roxy-wi/issues/285
CVE: CVE-2021-38168
Published: 2021-08-07
Description: Roxy-WI through 5.2.2.0 allows authenticated SQL injection via select_servers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/hap-wi/roxy-wi/issues/285; https://github.com/hap-wi/roxy-wi/issues/285
CVE: CVE-2021-38169
Published: 2021-08-07
Description: Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/hap-wi/roxy-wi/issues/285; https://github.com/hap-wi/roxy-wi/issues/285
CVE: CVE-2021-38173
Published: 2021-08-07
Description: Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/digint/btrbk/blob/master/ChangeLog; https://github.com/digint/btrbk/commit/58212de771c381cd4fa[PII_REDACTED]0bf264e9584; https://lists.debian.org/debian-lts-announce/2021/09/msg00002.html
CVE: CVE-2021-38185
Published: 2021-08-08
Description: GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dd[PII_REDACTED]1703e19272fe25034560b794061b; https://github.com/fangqyi/cpiopwn; https://lists.debian.org/debian-lts-announce/2023/06/msg00007.html
CVE: CVE-2020-36432
Published: 2021-08-08
Description: An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. There is a drop of uninitialized memory in Matrix::new().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/alg_ds/RUSTSEC-2020-0033.md; https://rustsec.org/advisories/RUSTSEC-2020-0033.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/alg_ds/RUSTSEC-2020-0033.md
CVE: CVE-2020-36433
Published: 2021-08-08
Description: An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
CVSS Score: 7.5 (HIGH)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/chunky/RUSTSEC-2020-0035.md; https://rustsec.org/advisories/RUSTSEC-2020-0035.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/chunky/RUSTSEC-2020-0035.md
CVE: CVE-2020-36434
Published: 2021-08-08
Description: An issue was discovered in the sys-info crate before 0.8.0 for Rust. sys_info::disk_info calls can trigger a double free.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/sys-info/RUSTSEC-2020-0100.md; https://rustsec.org/advisories/RUSTSEC-2020-0100.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/sys-info/RUSTSEC-2020-0100.md
CVE: CVE-2020-36435
Published: 2021-08-08
Description: An issue was discovered in the ruspiro-singleton crate before 0.4.1 for Rust. In Singleton, Send and Sync do not have bounds checks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ruspiro-singleton/RUSTSEC-2020-0115.md; https://rustsec.org/advisories/RUSTSEC-2020-0115.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ruspiro-singleton/RUSTSEC-2020-0115.md
CVE: CVE-2020-36436
Published: 2021-08-08
Description: An issue was discovered in the unicycle crate before 0.7.1 for Rust. PinSlab<T> and Unordered<T, S> do not have bounds on their Send and Sync traits.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/unicycle/RUSTSEC-2020-0116.md; https://rustsec.org/advisories/RUSTSEC-2020-0116.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/unicycle/RUSTSEC-2020-0116.md
CVE: CVE-2020-36437
Published: 2021-08-08
Description: An issue was discovered in the conqueue crate before 0.4.0 for Rust. There are unconditional implementations of Send and Sync for QueueSender<T>.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/conqueue/RUSTSEC-2020-0117.md; https://rustsec.org/advisories/RUSTSEC-2020-0117.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/conqueue/RUSTSEC-2020-0117.md
CVE: CVE-2020-36438
Published: 2021-08-08
Description: An issue was discovered in the tiny_future crate before 0.4.0 for Rust. Future<T> does not have bounds on its Send and Sync traits.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tiny_future/RUSTSEC-2020-0118.md; https://rustsec.org/advisories/RUSTSEC-2020-0118.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tiny_future/RUSTSEC-2020-0118.md
CVE: CVE-2020-36439
Published: 2021-08-08
Description: An issue was discovered in the ticketed_lock crate before 0.3.0 for Rust. There are unconditional implementations of Send for ReadTicket<T> and WriteTicket<T>.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ticketed_lock/RUSTSEC-2020-0119.md; https://rustsec.org/advisories/RUSTSEC-2020-0119.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ticketed_lock/RUSTSEC-2020-0119.md
CVE: CVE-2020-36440
Published: 2021-08-08
Description: An issue was discovered in the libsbc crate before 0.1.5 for Rust. For Decoder<R>, it implements Send for any R: Read.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libsbc/RUSTSEC-2020-0120.md; https://rustsec.org/advisories/RUSTSEC-2020-0120.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libsbc/RUSTSEC-2020-0120.md
CVE: CVE-2020-36441
Published: 2021-08-08
Description: An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox<T> with no requirement for T: Send and T: Sync.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abox/RUSTSEC-2020-0121.md; https://rustsec.org/advisories/RUSTSEC-2020-0121.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abox/RUSTSEC-2020-0121.md
CVE: CVE-2020-36442
Published: 2021-08-08
Description: An issue was discovered in the beef crate before 0.5.0 for Rust. beef::Cow has no Sync bound on its Send trait.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/beef/RUSTSEC-2020-0122.md; https://rustsec.org/advisories/RUSTSEC-2020-0122.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/beef/RUSTSEC-2020-0122.md
CVE: CVE-2020-36443
Published: 2021-08-08
Description: An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libp2p-deflate/RUSTSEC-2020-0123.md; https://rustsec.org/advisories/RUSTSEC-2020-0123.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libp2p-deflate/RUSTSEC-2020-0123.md
CVE: CVE-2020-36444
Published: 2021-08-08
Description: An issue was discovered in the async-coap crate through 2020-12-08 for Rust. Send and Sync are implemented for ArcGuard<RC, T> without trait bounds on RC.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/async-coap/RUSTSEC-2020-0124.md; https://rustsec.org/advisories/RUSTSEC-2020-0124.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/async-coap/RUSTSEC-2020-0124.md
CVE: CVE-2020-36445
Published: 2021-08-08
Description: An issue was discovered in the convec crate through 2020-11-24 for Rust. There are unconditional implementations of Send and Sync for ConVec<T>.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/convec/RUSTSEC-2020-0125.md; https://rustsec.org/advisories/RUSTSEC-2020-0125.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/convec/RUSTSEC-2020-0125.md
CVE: CVE-2020-36446
Published: 2021-08-08
Description: An issue was discovered in the signal-simple crate through 2020-11-15 for Rust. There are unconditional implementations of Send and Sync for SyncChannel<T>.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/signal-simple/RUSTSEC-2020-0126.md; https://rustsec.org/advisories/RUSTSEC-2020-0126.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/signal-simple/RUSTSEC-2020-0126.md
CVE: CVE-2020-36447
Published: 2021-08-08
Description: An issue was discovered in the v9 crate through 2020-12-18 for Rust. There is an unconditional implementation of Sync for SyncRef<T>.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/v9/RUSTSEC-2020-0127.md; https://rustsec.org/advisories/RUSTSEC-2020-0127.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/v9/RUSTSEC-2020-0127.md
CVE: CVE-2020-36448
Published: 2021-08-08
Description: An issue was discovered in the cache crate through 2020-11-24 for Rust. There are unconditional implementations of Send and Sync for Cache<K>.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cache/RUSTSEC-2020-0128.md; https://rustsec.org/advisories/RUSTSEC-2020-0128.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cache/RUSTSEC-2020-0128.md
CVE: CVE-2020-36449
Published: 2021-08-08
Description: An issue was discovered in the kekbit crate before 0.3.4 for Rust. For ShmWriter<H>, Send is implemented without requiring H: Send.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/kekbit/RUSTSEC-2020-0129.md; https://rustsec.org/advisories/RUSTSEC-2020-0129.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/kekbit/RUSTSEC-2020-0129.md
CVE: CVE-2020-36450
Published: 2021-08-08
Description: An issue was discovered in the bunch crate through 2020-11-12 for Rust. There are unconditional implementations of Send and Sync for Bunch<T>.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/bunch/RUSTSEC-2020-0130.md; https://rustsec.org/advisories/RUSTSEC-2020-0130.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/bunch/RUSTSEC-2020-0130.md
CVE: CVE-2020-36451
Published: 2021-08-08
Description: An issue was discovered in the rcu_cell crate through 2020-11-14 for Rust. There are unconditional implementations of Send and Sync for RcuCell<T>.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rcu_cell/RUSTSEC-2020-0131.md; https://rustsec.org/advisories/RUSTSEC-2020-0131.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rcu_cell/RUSTSEC-2020-0131.md
CVE: CVE-2020-36452
Published: 2021-08-08
Description: An issue was discovered in the array-tools crate before 0.3.2 for Rust. FixedCapacityDequeLike::clone() has a drop of uninitialized memory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/array-tools/RUSTSEC-2020-0132.md; https://rustsec.org/advisories/RUSTSEC-2020-0132.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/array-tools/RUSTSEC-2020-0132.md
CVE: CVE-2020-36453
Published: 2021-08-08
Description: An issue was discovered in the scottqueue crate through 2020-11-15 for Rust. There are unconditional implementations of Send and Sync for Queue<T>.
CVSS Score: 8.1 (HIGH)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/scottqueue/RUSTSEC-2020-0133.md; https://rustsec.org/advisories/RUSTSEC-2020-0133.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/scottqueue/RUSTSEC-2020-0133.md
CVE: CVE-2020-36454
Published: 2021-08-08
Description: An issue was discovered in the parc crate through 2020-11-14 for Rust. LockWeak<T> has an unconditional implementation of Send without trait bounds on T.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/parc/RUSTSEC-2020-0134.md; https://rustsec.org/advisories/RUSTSEC-2020-0134.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/parc/RUSTSEC-2020-0134.md
CVE: CVE-2020-36455
Published: 2021-08-08
Description: An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock<T> unconditionally implements Send and Sync.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/slock/RUSTSEC-2020-0135.md; https://rustsec.org/advisories/RUSTSEC-2020-0135.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/slock/RUSTSEC-2020-0135.md
CVE: CVE-2020-36456
Published: 2021-08-08
Description: An issue was discovered in the toolshed crate through 2020-11-15 for Rust. In CopyCell<T>, the Send trait lacks bounds on the contained type.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/toolshed/RUSTSEC-2020-0136.md; https://rustsec.org/advisories/RUSTSEC-2020-0136.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/toolshed/RUSTSEC-2020-0136.md
CVE: CVE-2020-36457
Published: 2021-08-08
Description: An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox<T> implements the Send and Sync traits for all types T.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lever/RUSTSEC-2020-0137.md; https://rustsec.org/advisories/RUSTSEC-2020-0137.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lever/RUSTSEC-2020-0137.md
CVE: CVE-2020-36458
Published: 2021-08-08
Description: An issue was discovered in the lexer crate through 2020-11-10 for Rust. For ReaderResult<T, E>, there is an implementation of Sync with a trait bound of T: Send, E: Send.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lexer/RUSTSEC-2020-0138.md; https://rustsec.org/advisories/RUSTSEC-2020-0138.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lexer/RUSTSEC-2020-0138.md
CVE: CVE-2020-36459
Published: 2021-08-08
Description: An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/dces/RUSTSEC-2020-0139.md; https://rustsec.org/advisories/RUSTSEC-2020-0139.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/dces/RUSTSEC-2020-0139.md
CVE: CVE-2020-36460
Published: 2021-08-08
Description: An issue was discovered in the model crate through 2020-11-10 for Rust. The Shared data structure has an implementation of the Send and Sync traits without regard for the inner type.
CVSS Score: 8.1 (HIGH)
CWE: CWE-843
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/model/RUSTSEC-2020-0140.md; https://rustsec.org/advisories/RUSTSEC-2020-0140.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/model/RUSTSEC-2020-0140.md
CVE: CVE-2020-36461
Published: 2021-08-08
Description: An issue was discovered in the noise_search crate through 2020-12-10 for Rust. There are unconditional implementations of Send and Sync for MvccRwLock.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/noise_search/RUSTSEC-2020-0141.md; https://rustsec.org/advisories/RUSTSEC-2020-0141.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/noise_search/RUSTSEC-2020-0141.md
CVE: CVE-2020-36462
Published: 2021-08-08
Description: An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/syncpool/RUSTSEC-2020-0142.md; https://rustsec.org/advisories/RUSTSEC-2020-0142.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/syncpool/RUSTSEC-2020-0142.md
CVE: CVE-2020-36463
Published: 2021-08-08
Description: An issue was discovered in the multiqueue crate through 2020-12-25 for Rust. There are unconditional implementations of Send for InnerSend<RW, T>, InnerRecv<RW, T>, FutInnerSend<RW, T>, and FutInnerRecv<RW, T>.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/multiqueue/RUSTSEC-2020-0143.md; https://rustsec.org/advisories/RUSTSEC-2020-0143.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/multiqueue/RUSTSEC-2020-0143.md
CVE: CVE-2020-36464
Published: 2021-08-08
Description: An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whether it has already been partially consumed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/heapless/RUSTSEC-2020-0145.md; https://rustsec.org/advisories/RUSTSEC-2020-0145.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/heapless/RUSTSEC-2020-0145.md
CVE: CVE-2020-36465
Published: 2021-08-08
Description: An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes.
CVSS Score: 7.5 (HIGH)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/generic-array/RUSTSEC-2020-0146.md; https://rustsec.org/advisories/RUSTSEC-2020-0146.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/generic-array/RUSTSEC-2020-0146.md
CVE: CVE-2020-36466
Published: 2021-08-08
Description: An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr implements Send and Sync for all types.
CVSS Score: 5.9 (MEDIUM)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cgc/RUSTSEC-2020-0148.md; https://rustsec.org/advisories/RUSTSEC-2020-0148.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cgc/RUSTSEC-2020-0148.md
CVE: CVE-2020-36467
Published: 2021-08-08
Description: An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::get returns more than one mutable reference to the same object.
CVSS Score: 5.9 (MEDIUM)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cgc/RUSTSEC-2020-0148.md; https://rustsec.org/advisories/RUSTSEC-2020-0148.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cgc/RUSTSEC-2020-0148.md
CVE: CVE-2020-36468
Published: 2021-08-08
Description: An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::write performs non-atomic write operations on an underlying pointer.
CVSS Score: 5.9 (MEDIUM)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cgc/RUSTSEC-2020-0148.md; https://rustsec.org/advisories/RUSTSEC-2020-0148.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cgc/RUSTSEC-2020-0148.md
CVE: CVE-2020-36469
Published: 2021-08-08
Description: An issue was discovered in the appendix crate through 2020-11-15 for Rust. For the generic K and V type parameters, Send and Sync are implemented unconditionally.
CVSS Score: 5.9 (MEDIUM)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/appendix/RUSTSEC-2020-0149.md; https://rustsec.org/advisories/RUSTSEC-2020-0149.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/appendix/RUSTSEC-2020-0149.md
CVE: CVE-2020-36470
Published: 2021-08-08
Description: An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references.
CVSS Score: 5.9 (MEDIUM)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/disrustor/RUSTSEC-2020-0150.md; https://rustsec.org/advisories/RUSTSEC-2020-0150.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/disrustor/RUSTSEC-2020-0150.md
CVE: CVE-2020-36471
Published: 2021-08-08
Description: An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
CVSS Score: 5.9 (MEDIUM)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/generator/RUSTSEC-2020-0151.md; https://rustsec.org/advisories/RUSTSEC-2020-0151.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/generator/RUSTSEC-2020-0151.md
CVE: CVE-2020-36472
Published: 2021-08-08
Description: An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander<EI> types that they contain.
CVSS Score: 5.9 (MEDIUM)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/max7301/RUSTSEC-2020-0152.md; https://rustsec.org/advisories/RUSTSEC-2020-0152.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/max7301/RUSTSEC-2020-0152.md
CVE: CVE-2021-36221
Published: 2021-08-08
Description: Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf; https://groups.google.com/forum/#%21forum/golang-announce; https://groups.google.com/g/golang-announce/c/JvWG9FUUYT0
CVE: CVE-2021-38186
Published: 2021-08-08
Description: An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/comrak/RUSTSEC-2021-0063.md; https://rustsec.org/advisories/RUSTSEC-2021-0063.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/comrak/RUSTSEC-2021-0063.md
CVE: CVE-2021-38187
Published: 2021-08-08
Description: An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a *u8 to a *u64.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-681
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/anymap/RUSTSEC-2021-0065.md; https://rustsec.org/advisories/RUSTSEC-2021-0065.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/anymap/RUSTSEC-2021-0065.md
CVE: CVE-2021-38188
Published: 2021-08-08
Description: An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new(), slice.get_unchecked(slice.length()) is used unsafely.
CVSS Score: 9.8 (CRITICAL)
References: https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/iced-x86/RUSTSEC-2021-0068.md; https://rustsec.org/advisories/RUSTSEC-2021-0068.html; https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/iced-x86/RUSTSEC-2021-0068.md