Security Vulnerabilities - CVEs Published In 2021
An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. There is a drop of uninitialized memory in Matrix::new().
CVSS Score
9.8
EPSS Score
0.012
Published
2021-08-08
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
CVSS Score
7.5
EPSS Score
0.009
Published
2021-08-08
An issue was discovered in the sys-info crate before 0.8.0 for Rust. sys_info::disk_info calls can trigger a double free.
CVSS Score
9.8
EPSS Score
0.012
Published
2021-08-08
An issue was discovered in the ruspiro-singleton crate before 0.4.1 for Rust. In Singleton, Send and Sync do not have bounds checks.
CVSS Score
8.1
EPSS Score
0.008
Published
2021-08-08
An issue was discovered in the unicycle crate before 0.7.1 for Rust. PinSlab<T> and Unordered<T, S> do not have bounds on their Send and Sync traits.
CVSS Score
8.1
EPSS Score
0.008
Published
2021-08-08
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
CVSS Score
7.8
EPSS Score
0.042
Published
2021-08-08
Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys.
CVSS Score
9.8
EPSS Score
0.032
Published
2021-08-07
In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.
CVSS Score
7.8
EPSS Score
0.003
Published
2021-08-07
Roxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can extract a valid uuid to bypass authentication.
CVSS Score
9.8
EPSS Score
0.013
Published
2021-08-07
Roxy-WI through 5.2.2.0 allows authenticated SQL injection via select_servers.
CVSS Score
8.8
EPSS Score
0.009
Published
2021-08-07