Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
rust vulnerabilities and exploits
(subscribe to this query)
5.9
CVSSv3
CVE-2022-46176
Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been ...
Rust-lang Cargo
8.1
CVSSv3
CVE-2022-36113
Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" ...
Rust-lang Cargo
1 Github repository
6.5
CVSSv3
CVE-2022-36114
Cargo is a package manager for the rust programming language. It exists that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that extracts way more data than its size (also kn...
Rust-lang Cargo
9.8
CVSSv3
CVE-2019-16143
An issue exists in the blake2 crate prior to 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes.
Blake2 Blake2-rust
6.1
CVSSv3
CVE-2020-26297
mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affecting the search feature of mdBook, which could allow an malicious user to execute arbitrary JavaScript code on the page. The...
Rust-lang Mdbook
2 Github repositories
5.5
CVSSv3
CVE-2020-35920
An issue exists in the socket2 crate prior to 0.3.16 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
Rust-lang Socket2
6.1
CVSSv3
CVE-2020-36202
An issue exists in the async-h1 crate prior to 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy.
Rust-lang Async-h1
9.8
CVSSv3
CVE-2020-5499
Baidu Rust SGX SDK up to and including 1.0.8 has an enclave ID race. There are non-deterministic results in which, sometimes, two global IDs are the same.
Apache Rust Sgx Sdk
7.5
CVSSv3
CVE-2020-26281
async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server d...
Rust-lang Async-h1
7.5
CVSSv3
CVE-2022-39252
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a...
Matrix Matrix-rust-sdk
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322
cross-site request forgery
unauthorized
CVE-2024-33925
reflected XSS
CVE-2023-51580
CVE-2023-51579
CVE-2015-2051
CVE-2023-51609
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »