Ecosystem
Alpine
10,677 known vulnerabilities.
Most affected packages
794 results · Clear filters · Feed
-
Unscored —
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded serv…
-
Unscored —
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker ca…
-
Unscored —
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to…
-
Unscored —CVE-2019-6215 Public exploit
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Saf…
-
Unscored —
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc …
-
Medium 5.4CVE-2018-16890 Public exploit
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling …
-
Unscored —
A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This resul…
-
Medium 5.9
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses w…
-
Unscored —
gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch func…
-
Unscored —
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attac…
-
High 7.5
A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes…
-
High 7.5
An error in TSIG authentication can permit unauthorized dynamic updates
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BI…
-
High 7.2CVE-2017-3141 Public exploit
Windows service and uninstall paths are not quoted when BIND is installed
The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.…
-
Unscored —
An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-rea…
-
Unscored —
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via …
-
Unscored —
An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read b…
-
Unscored —
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd…
-
Unscored —CVE-2019-6250 Public exploit
A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_d…
-
Unscored —CVE-2018-6126 Public exploit
A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds …
-
High 8.8
Archive_Tar contains Potential RCE if filename starts with phar://
PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called with…
-
Critical 9.8
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checkin…
-
Unscored —
A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully exe…
-
Unscored —
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/…
-
Unscored —
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh …
-
Unscored —CVE-2018-5407 Public exploit
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attack…
-
Medium 5.3
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessiv…
-
Unscored —
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabl…
-
Medium 6.1CVE-2016-6328 Public exploit
A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can…
-
Unscored —
ACME mini_httpd before 1.30 lets remote users read arbitrary files.
-
Unscored —
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options w…
-
Unscored —
LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.…
-
Critical 9.1
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client cou…
-
Unscored —CVE-2018-17961 Public exploit
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving er…
-
Unscored —
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x b…
-
High 7.5
High severity vulnerability that affects OPCFoundation.NetStandard.Opc.Ua
Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.
-
Unscored —
libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a deni…
-
Medium 5.9
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticat…
-
Unscored —
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turne…
-
Medium 5.3CVE-2018-10906 Public exploit
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is ac…
-
High 8.1
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is relat…
KEV Apr 13, 2022