Ecosystem
Alpine
10,696 known vulnerabilities.
Most affected packages
2,533 results · Clear filters · Feed
-
Medium 5.3
SaltStack Salt Directory Traversal vulnerability in salt-api
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
-
Medium 5.9
Pyopenssl Incorrect Memory Management
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack…
-
Medium 5.3CVE-2018-14647 EPSS 11%
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it eas…
-
Medium 5.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker i…
-
Medium 5.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a r…
-
Medium 5.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker i…
-
Medium 5.3
An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated att…
-
Medium 6.1
phpMyAdmin Cross-site Scripting (XSS) in the import dialog
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
-
Medium 5.2
A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An aut…
-
Medium 4.3
A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malic…
-
Medium 4.3
The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access contr…
-
Medium 6.5CVE-2018-1140 EPSS 11%
A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker…
-
Medium 5.4
A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1…
-
Medium 5.9
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticat…
-
Medium 5.6
Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure…
-
Medium 5.6
Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure…
-
Medium 6.1
Django open redirect
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
-
Medium 5.3
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leadin…
-
Medium 5.3
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back…
-
Medium 5.3
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead user…
-
Medium 5.3
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
-
Medium 6.5
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read v…
-
Medium 5.3
The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an inpu…
-
Medium 5.3
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with…
-
Medium 5.3
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to …
-
Medium 4.2
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtu…
-
Medium 5.5
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; …
-
Medium 5.5
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds…
-
Medium 4.3
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the…
-
Medium 5.5
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local…
-
Medium 5.2
It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially u…
-
Medium 6.5
It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user syst…
-
Medium 4.1
An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14…
-
Medium 6.1
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024…
-
Medium 5.3CVE-2018-10906 Public exploit
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is ac…
-
Medium 6.5
Nokogiri NULL Pointer Dereference
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with th…
-
Medium 4.8
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client ce…
-
Medium 6.5
In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an …
-
Medium 5.9
Ansible exposes sensitive data in log files and on the terminal
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expo…
-
Medium 5.5
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access iss…