Ecosystem
Alpine
10,696 known vulnerabilities.
Most affected packages
2,533 results · Clear filters · Feed
-
Medium 6.5
Improper sanitization of Transfer-Encoding headers in net/http
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
-
Medium 5.9
.NET Spoofing Vulnerability
.NET Spoofing Vulnerability
-
Medium 5.9
Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks
Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited i…
-
Medium 6.5
Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who …
-
Medium 4.4
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Medium 5.5
The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (app…
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.9
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…
-
Medium 4.3CVE-2022-32205 EPSS 31%
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 st…
-
Medium 6.5CVE-2022-32206 EPSS 36%
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …
-
Medium 5.9
Double free of buffer during string decoding in ujson
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the …
-
Medium 5.3
NULL Pointer Dereference in lxml/lxml
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through fo…
-
Medium 5.5
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file…
-
Medium 5.5
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file…
-
Medium 5.5
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file…
-
Medium 6.5
URL previews can crash Synapse media repositories or Synapse monoliths
Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverabl…
-
Medium 5.3
Observable timing discrepancy allows determining username validity in Jenkins
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkin…
-
Medium 5.3
golang.org/x/sys/unix has Incorrect privilege reporting in syscall
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
-
Medium 5.5
.NET and Visual Studio Information Disclosure Vulnerability
.NET and Visual Studio Information Disclosure Vulnerability
-
Medium 5.5
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticate…
-
Medium 5.5
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to po…
-
Medium 5.5
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potenti…
-
Medium 4.3
Forced Browsing in Jupyter Notebook
Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not a…
-
Medium 5.5
containerd CRI plugin: Host memory exhaustion through ExecSync
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause co…
-
Medium 5.3
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, m…
-
Medium 5.7
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that c…
-
Medium 6.5
Uncaught Exception (due to a data race) leads to process termination in Waitress
Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exceptio…
-
Medium 6.7
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.
-
Medium 6.7
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.
-
Medium 6.7
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.
-
Medium 6.7
A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
-
Medium 6.5
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel exe…
-
Medium 5.3
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occur…
-
Medium 6.6CVE-2022-29170 Public exploit
Grafana Enterprise datasource network restrictions bypass via HTTP redirects
Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present…
-
Medium 6.6
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.4979.
-
Medium 5.9
Incorrect Default Permissions in runc
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an aty…
-
Medium 6.5CVE-2022-22971 Public exploit
Allocation of Resources Without Limits or Throttling in Spring Framework
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
-
Medium 5.5
Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an auth…