Security Vulnerabilities - CVEs Published In 2021
unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.
CVSS Score
9.8
EPSS Score
0.021
Published
2021-08-08
This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.
CVSS Score
7.3
EPSS Score
0.011
Published
2021-08-08
An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime.
CVSS Score
7.5
EPSS Score
0.011
Published
2021-08-08
An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
CVSS Score
6.1
EPSS Score
0.007
Published
2021-08-08
An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mul_by_inverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified.
CVSS Score
9.8
EPSS Score
0.013
Published
2021-08-08
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
CVSS Score
9.8
EPSS Score
0.009
Published
2021-08-08
An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose.
CVSS Score
9.8
EPSS Score
0.026
Published
2021-08-08
An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2.
CVSS Score
8.1
EPSS Score
0.012
Published
2021-08-08
An issue was discovered in the multiqueue crate through 2020-12-25 for Rust. There are unconditional implementations of Send for InnerSend<RW, T>, InnerRecv<RW, T>, FutInnerSend<RW, T>, and FutInnerRecv<RW, T>.
CVSS Score
8.1
EPSS Score
0.011
Published
2021-08-08
An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whether it has already been partially consumed.
CVSS Score
7.5
EPSS Score
0.012
Published
2021-08-08