RubyGem omniauth-facebook has an access token security vulnerability.
References
https://nvd.nist.gov/vuln/detail/CVE-2013-4593
https://exchange.xforce.ibmcloud.com/vulnerabilities/89040
https://security-tracker.debian.org/tracker/CVE-2013-4593
http:/…
A security issue was discovered in the Kubelet and kube-proxy components of Kubernetes which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node’s network namespace. For example, if a cluster admini…
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-41819
https://hackero…
The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-23437
https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd…
Affected versions of this crate unconditionally implement Sync for SyncRef<T>.
This definition allows data races if &T is accessible through &SyncRef.
SyncRef<T> derives Clone and Debug, and the default implementations of those trai…
Slock<T> unconditionally implements Send/Sync.
Affected versions of this crate allows sending non-Send types to other threads,
which can lead to data races and memory corruption due to the data race.
References
https://github.com/BrokenLamp/sloc…
An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock unconditionally implements Send and Sync.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-36455
https://github.com/BrokenLamp/slock-rs/issues/2
https://raw.githubuserco…
v9 is a slim data engine for Data Oriented Design. An issue was discovered in the v9 crate through 2020-12-18 for Rust. There is an unconditional implementation of Sync for SyncRef.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-36447
https://gi…
Impact
Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be rea…
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-25291
https://github.com/python-pillow/Pillow/commit/…
