Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-33966Deno missing "--allow-net" permission check for built-in Node modulescrates.io · deno, deno_runtime · fixed in 1.34.1, 0.115.0
- CVE-2023-33192Improper handling of NTS cookie length that could crash the ntpd-rs servercrates.io · ntpd · fixed in 0.3.3
- CVE-2023-31134Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sitescrates.io · tauri · fixed in 1.0.9, 1.1.4, 1.2.5
- CVE-2023-27075A cross-site scripting vulnerability (XSS) in the component microbin/src/pasta.rs of Microbin v1.2.0 allows attackers to execute arbitrary wcrates.io · microbin · fixed in 1.2.1
- CVE-2023-30624Wasmtime has Undefined Behavior in Rust runtime functionscrates.io · wasmtime · fixed in 6.0.2, 7.0.1, 8.0.1
- CVE-2023-30610AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sendingcrates.io · aws-sigv4 · fixed in 0.2.1, 0.3.1, 0.5.3 and more
- CVE-2023-26964An issue was discovered in hyper v0.13.7.crates.io · h2 · fixed in 0.3.17
- CVE-2023-28631Attacker controlled data in AST nodes is not validated in comrakcrates.io · comrak · fixed in 0.17.0
- CVE-2023-28626Quadratic runtime when parsing Markdown in comrakcrates.io · comrak · fixed in 0.17.0
- CVE-2023-28446Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralizationcrates.io · deno, deno_runtime · fixed in 1.31.2
- CVE-2023-28448Versionize is lacking bound checks, potentially leading to out of bounds memory accesscrates.io · versionize · fixed in 0.1.10
- CVE-2023-28445Deno improperly handles resizable ArrayBuffercrates.io · deno, deno_runtime +1 · fixed in 1.32.1, 0.103.0, 0.88.0
- CVE-2023-28431Frontier's modexp precompile is slow for even moduluscrates.io · pallet-evm-precompile-modexp
- CVE-2023-28113russh may use insecure Diffie-Hellman keyscrates.io · russh · fixed in 0.36.2, 0.37.1
- CVE-2023-26489Guest-controlled out-of-bounds read/write on x86_64 in wasmtimecrates.io · cranelift-codegen, wasmtime · fixed in 0.91.1, 0.92.1, 0.93.1 and more
- CVE-2023-27477wasmtime is a fast and secure runtime for WebAssembly.crates.io · cranelift-codegen, wasmtime · fixed in 0.91.1, 0.92.1, 0.93.1 and more
- CVE-2023-26103Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket functicrates.io · deno · fixed in 1.31.0
- CVE-2022-4203X.509 Name Constraints Read Buffer Overflowcrates.io · openssl-src · fixed in 300.0.12
- CVE-2022-4304Timing Oracle in RSA Decryptioncrates.io · openssl-src · fixed in 111.25.0, 300.0.12
- CVE-2022-4450Double free after calling PEM_read_bio_excrates.io · openssl-src · fixed in 111.25.0, 300.0.12
- CVE-2023-0215Use-after-free following BIO_new_NDEFcrates.io · openssl-src · fixed in 111.25.0, 300.0.12
- CVE-2023-0216Invalid pointer dereference in d2i_PKCS7 functionscrates.io · openssl-src · fixed in 300.0.12
- CVE-2023-0217NULL dereference validating DSA public keycrates.io · openssl-src · fixed in 300.0.12
- CVE-2023-0286X.400 address type confusion in X.509 GeneralNamecrates.io · openssl-src · fixed in 111.25.0, 300.0.12
- CVE-2023-0401NULL dereference during PKCS7 data verificationcrates.io · openssl-src · fixed in 300.0.12
- CVE-2023-22742libgit2 fails to verify SSH keys by defaultcrates.io · git2, libgit2-sys · fixed in 0.16.1, 0.13.5, 0.14.2
- CVE-2023-22499Interactive permission prompt spoofing in Denocrates.io · deno · fixed in 1.29.3
- CVE-2022-45299An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.crates.io · webbrowser · fixed in 0.8.3
- CVE-2022-46176Cargo did not verify SSH host keyscrates.io · cargo · fixed in 0.67.1
- CVE-2023-22895The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in memcrates.io · bzip2 · fixed in 0.4.4