CVE-2018-20993

An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.

Source: CVE-2018-20993

CVE-2017-18587

An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.

Source: CVE-2017-18587

CVE-2016-10932

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.

Source: CVE-2016-10932

CVE-2016-10933

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.

Source: CVE-2016-10933

CVE-2019-15534

Raml-Module-Builder 26.4.0 allows SQL Injection in PostgresClient.update.

Source: CVE-2019-15534

CVE-2019-15532

CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.

Source: CVE-2019-15532

CVE-2019-15489

laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.

Source: CVE-2019-15489

CVE-2019-15506

An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. There are a number of directories affected.

Source: CVE-2019-15506

CVE-2019-15541

rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.

Source: CVE-2019-15541

CVE-2016-10931

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.

Source: CVE-2016-10931