Ecosystem
Alpine
10,769 known vulnerabilities.
Most affected packages
10,730 results · Feed
-
Medium 5.3
golang.org/x/sys/unix has Incorrect privilege reporting in syscall
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Buffer Over-read in vim/vim
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
-
High 7.5
mysqlnd/pdo password buffer overflow
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigg…
-
High 8.1
Freeing unallocated memory in php_pgsql_free_params()
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This …
-
Unscored —
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' …
-
Unscored —
In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'fl…
-
Unscored —
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' …
-
Medium 5.5
.NET and Visual Studio Information Disclosure Vulnerability
.NET and Visual Studio Information Disclosure Vulnerability
-
Medium 5.5
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticate…
-
Medium 5.5
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to po…
-
Medium 5.5
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potenti…
-
Medium 4.3
Forced Browsing in Jupyter Notebook
Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not a…
-
Unscored —
A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of me…
-
Unscored —
x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular …
-
Unscored —
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —CVE-2022-31813 Public exploit
mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
-
Unscored —
Information Disclosure in mod_lua with websockets
Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
-
Unscored —CVE-2022-30522 EPSS 90%
mod_sed denial of service
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
-
Unscored —
Denial of service in mod_lua r:parsebody
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
-
Critical 9.1
Read beyond bounds in ap_strcmp_match()
Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party…
-
Unscored —
read beyond bounds via ap_rwrite()
The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distrib…
-
Unscored —
read beyond bounds in mod_isapi
Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.
-
Unscored —
mod_proxy_ajp: Possible request smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Se…
-
High 7.5
Node DOS by way of memory exhaustion through ExecSync request in CRI-O
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after co…
-
Critical 9.8
Potential stack buffer overflow when parsing message as a STUN client
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJ…
-
Critical 9.3
Authorization Bypass Through User-Controlled Key in emicklei/go-restful
Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.
-
Medium 5.5
containerd CRI plugin: Host memory exhaustion through ExecSync
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause co…
-
Critical 9.8
miniOrange SAML Authentication Bypass
Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization b…
-
Unscored —
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is use…
-
High 8.3
Server-Side Request Forgery (SSRF) in gogs/gogs
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.
-
Medium 5.3
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, m…
-
High 7.5
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address th…
-
Unscored —
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header…
-
High 7.5
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…
-
Unscored —
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.c…
-
Medium 5.7
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that c…