2020

An issue was discovered in the net2 crate before 0.2.36 for Rust. It has false expectations about the std::net::SocketAd

An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic

An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free

An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In th

An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust. GenericMutexGuard allows cross-thread data

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard u

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard un

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteG

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGu

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedMutexGuard u

An issue was discovered in the multihash crate before 0.11.3 for Rust. The from_slice parsing code can panic via unsanit

An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption be

An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL poin

An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free

An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certa

An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It has incorrect expectations about the re

An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is

An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed.

An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.

An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A pop_back() call may lead to a use-after-

An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more

An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more th

HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command

HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of spe

HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL para

HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inj

HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax

The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can us

HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password gener

The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB

Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being re

The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a sta

NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole

The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access a

modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP r

includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies

OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of

Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command executio

Exponent CMS before 2.6.0 has improper input validation in fileController.php.

Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.

Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.

Exponent CMS before 2.6.0 has improper input validation in usersController.php.

Exponent CMS before 2.6.0 has improper input validation in storeController.php.

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.

USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or n

XWiki Platform before 12.8 mishandles escaping in the property displayer.

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c

iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated informat

In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define()

URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be sp