Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-22466Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipecrates.io · tokio · fixed in 1.18.4, 1.20.3, 1.23.1
- CVE-2022-46171Tauri vulnerable to path traversalcrates.io · tauri · fixed in 1.0.8, 1.1.3, 1.2.3 and more
- CVE-2022-23507Light client verification not taking into account chain IDcrates.io · tendermint-light-client, tendermint-light-client-js +1 · fixed in 0.28.0
- CVE-2022-3996X.509 Policy Constraints Double Lockingcrates.io · openssl-src · fixed in 300.0.12
- CVE-2022-23523rust-vmm linux-loader vulnerable to Out-of-bounds Readcrates.io · linux-loader · fixed in 0.8.1
- CVE-2022-23486libp2p-rust denial of service vulnerability from lack of resource managementcrates.io · libp2p · fixed in 0.45.1
- CVE-2022-46149Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.crates.io · capnp · fixed in 0.13.7, 0.14.11, 0.15.2
- CVE-2022-39397Exposure of sensitive information in aliyun-oss-clientcrates.io · aliyun-oss-client · fixed in 0.8.1
- CVE-2022-39392Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configurationcrates.io · wasmtime · fixed in 1.0.2, 2.0.2
- CVE-2022-39393Wasmtime vulnerable to data leakage between instances in the pooling allocatorcrates.io · wasmtime · fixed in 2.0.2, 1.0.2
- CVE-2022-39394wasmtime_trap_code C API function has out of bounds write vulnerabilitycrates.io · wasmtime · fixed in 1.0.2, 2.0.2
- CVE-2022-41874Tauri Filesystem Scope can be Partially Bypassedcrates.io · tauri · fixed in 1.0.7, 1.1.2
- CVE-2022-3602X.509 Email Address 4-byte Buffer Overflowcrates.io · openssl-src · fixed in 300.0.11
- CVE-2022-3786X.509 Email Address Variable Length Buffer Overflowcrates.io · openssl-src · fixed in 300.0.11
- CVE-2022-39294(DoS) Denial of Service from unchecked request length in conduit-hypercrates.io · conduit-hyper · fixed in 0.4.2
- CVE-2022-39354evm has incorrect is_static parameter for custom stateful precompilescrates.io · evm · fixed in 0.36.0
- CVE-2022-3358Using a Custom Cipher with NID_undef may lead to NULL encryptioncrates.io · openssl-src · fixed in 300.0.10
- CVE-2022-39292Exposure of sensitive Slack webhook URLs in debug logs and tracescrates.io · slack-morphism · fixed in 1.3.2
- CVE-2022-39252When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwardercrates.io · matrix-sdk-crypto · fixed in 0.6.0
- CVE-2022-39242Incorrect Calculation in Frontier leads to inflated Ethereum chain gas pricescrates.io · pallet-ethereum
- CVE-2022-39974WASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h.crates.io · wasm3
- CVE-2022-39215The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauricrates.io · tauri · fixed in 1.0.6
- CVE-2022-3212DoS in axum-core due to missing request size limitcrates.io · axum-core · fixed in 0.2.8, 0.3.0-rc.2
- CVE-2022-36113Extracting malicious crates can corrupt arbitrary filescrates.io · cargo · fixed in 0.65.0, 0.67.0
- CVE-2022-36114Extracting malicious crates can fill the file systemcrates.io · cargo · fixed in 0.65.0, 0.67.0
- CVE-2022-3029Fatal error on incorrect base64 data in RRDPcrates.io · routinator · fixed in 0.11.3
- CVE-2022-36086linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`crates.io · linked_list_allocator · fixed in 0.10.2
- CVE-2022-25903Denial of Service (DoS)crates.io · opcua · fixed in 0.11.0
- CVE-2021-3917A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions.crates.io · coreos-installer · fixed in 0.10.0
- CVE-2022-25888Denial of Service (DoS)crates.io · opcua · fixed in 0.11.0