Ecosystem
Alpine
10,769 known vulnerabilities.
Most affected packages
10,730 results · Feed
-
Unscored —CVE-2022-0529 Public exploit
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…
-
Unscored —
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…
-
Medium 5.5
Insufficient control flow management in some Intel(R) Processors may allow an authenticated user to potentially enable …
-
Critical 9.8
Reuse of one time passwords allowed in Gitea
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.
-
Medium 5.5
Windows Common Log File System Driver Denial of Service Vulnerability
Windows Common Log File System Driver Denial of Service Vulnerability
-
Medium 6.5
DoS vulnerability in bundled XStream library in Jenkins Core
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.
-
Medium 6.1
Cross-site Scripting in Gitea
Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
-
Medium 6.3
Access of Memory Location Before Start of Buffer in radareorg/radare2
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
-
Medium 4.3
Exposure of Sensitive Information in Grafana
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by q…
-
Medium 6.3
Access of Memory Location After End of Buffer in radareorg/radare2
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
-
High 8.8
Use After Free in radareorg/radare2
Use After Free in NPM radare2.js prior to 5.6.2.
-
Medium 6.3
Cross Site Request Forgery in Grafana
Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-pri…
-
Medium 6.3
Buffer Access with Incorrect Length Value in radareorg/radare2
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.3
Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.5
Cross site scripting in Grafana proxy
Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cr…
-
High 7.1
Use After Free in radareorg/radare2
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
-
Critical 9.8
Capture-replay in Gitea
Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.
-
High 8.8
Cross Site Request Forgery in Gitea
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
-
High 8.8
Use After Free in radareorg/radare2
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
-
High 7.8
Privilege escalation on xrdp
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root.…
-
High 7.5
Cookie and header exposure in twisted
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLike…
-
Critical 9.8
Buffer overrun in CGI.escape_html
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 …
-
Medium 5.5
NULL Pointer Dereference in mruby/mruby
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
-
Unscored —
A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr_se…
-
High 7.5CVE-2022-23833 EPSS 50%
Infinite Loop in Django
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
-
Medium 6.1CVE-2022-22818 Public exploit
Cross-site Scripting in Django
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
-
High 7.0
Unchecked Class Instantiation when providing Plugin Classes
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc…
-
High 8.4
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.
-
Medium 6.5
Unsafe handling of user-specified cookies in treq
treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a dictionary. Such cookies are not bound to a single domain,…
-
Medium 5.9
NULL Pointer Dereference in radareorg/radare2
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.
-
Unscored —
MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common …
-
Unscored —
MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction wit…
-
Unscored —
MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.
-
Unscored —
MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.
-
Unscored —
MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.
-
Unscored —
MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.
-
Unscored —
MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact…
-
High 8.4
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.
-
Unscored —
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authentica…
-
Unscored —
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in g…