Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —
An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec26…
-
Unscored —
A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running …
-
Unscored —
An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in fu…
-
Critical 9.8CVE-2022-22822 Public exploit
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Unscored —
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0…
-
Medium 6.5
Out-of-bounds Read in Pillow
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
-
Critical 9.8
Arbitrary expression injection in Pillow
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
-
Medium 6.5
Improper Initialization in Pillow
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
-
High 7.1
Out-of-bounds Read in vim/vim
vim is vulnerable to Out-of-bounds Read
-
Unscored —
In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based…
-
Unscored —
The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the de…
-
Unscored —
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMake…
-
Unscored —
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.
-
High 8.1CVE-2021-46143 Public exploit
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
-
High 8.0
Improper Preservation of Permissions in containerd
containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the nod…
-
High 7.5
Denial-of-service in Django
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. I…
-
High 7.5
Information disclosure in Django
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an …
-
Medium 5.3
Directory-traversal in Django
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
-
Medium 5.9
Missing release of locks in PJSIP
PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when error/failure occurs, it is found that the function re…
-
High 8.2
Heap-based Buffer Overflow in mruby/mruby
mruby is vulnerable to Heap-based Buffer Overflow
-
High 8.8CVE-2021-45960 Public exploit
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…
-
High 7.5
golang.org/x/net/http2 allows uncontrolled memory consumption
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
-
Unscored —
Misdirected I/O in syscall
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.
-
High 7.5
Regular expression denial of service vulnerability (ReDoS) in date
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
-
High 7.5
Cookie Prefix Spoofing in CGI::Cookie.parse
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
-
Medium 5.5
UltraJSON vulnerable to Out-of-bounds Write
UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.
-
Medium 5.5
Out-of-bounds Read in vim/vim
vim is vulnerable to Out-of-bounds Read
-
Medium 5.5
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
Unscored —
OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThre…
-
Medium 6.8
NULL Pointer Dereference in mruby/mruby
mruby is vulnerable to NULL Pointer Dereference
-
High 7.5
Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injecti…
-
High 7.5
Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or…
-
High 7.5
Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injectio…
-
High 7.5
Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packe…
-
Medium 6.3
Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted ca…