CVE Vulnerability Database
Search and browse 394,607 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
18,322 records from 2020Clear filters
- CVE-2020-35860Critical 9.8Dec 31, 2020An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code.
- CVE-2020-35859Critical 9.1Dec 31, 2020An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust. It mishandles sigstack allocation. Guest programs may be able to obtain sensitive information, or guest programs can experience memory corruption.
- CVE-2020-35858Critical 9.8Dec 31, 2020An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message, causing a denial of service (e.g., x86) or possibly remote code execution (e.g., ARM).
- CVE-2020-35857High 7.5Dec 31, 2020An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption.
- CVE-2019-25010Critical 9.8Dec 31, 2020An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.
- CVE-2019-25009Critical 9.8Dec 31, 2020An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.
- CVE-2019-25007High 7.5Dec 31, 2020An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic.
- CVE-2019-25006High 7.5Dec 31, 2020An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
- CVE-2019-25005High 7.5Dec 31, 2020An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.
- CVE-2019-25004Critical 9.8Dec 31, 2020An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness.
- CVE-2019-25003High 7.5Dec 31, 2020An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers can obtain sensitive information.
- CVE-2019-25002Critical 9.8Dec 31, 2020An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties.
- CVE-2019-25001High 7.5Dec 31, 2020An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags.
- CVE-2018-25001Medium 6.5Dec 31, 2020An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.
- CVE-2020-35928Medium 4.7Dec 31, 2020An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync.
- CVE-2020-35927Medium 5.5Dec 31, 2020An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.
- CVE-2020-35926Critical 9.8Dec 31, 2020An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled.
- CVE-2020-35925Medium 5.5Dec 31, 2020An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.
- CVE-2020-35924Medium 5.5Dec 31, 2020An issue was discovered in the try-mutex crate before 0.3.0 for Rust. TryMutex<T> allows cross-thread sending of a non-Send type.
- CVE-2020-35923Medium 5.5Dec 31, 2020An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust. A NotNan value can contain a NaN.
- CVE-2020-35922Medium 5.5Dec 31, 2020An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
- CVE-2020-35921Medium 5.5Dec 31, 2020An issue was discovered in the miow crate before 0.3.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
- CVE-2020-35920Medium 5.5Dec 31, 2020An issue was discovered in the socket2 crate before 0.3.16 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
- CVE-2020-35919Medium 5.5Dec 31, 2020An issue was discovered in the net2 crate before 0.2.36 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
- CVE-2020-35918Medium 5.5Dec 31, 2020An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.