Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —
Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip
-
Unscored —
Chromium: CVE-2021-30613 Use after free in Base internals
-
Unscored —
Chromium: CVE-2021-30612 Use after free in WebRTC
-
Unscored —
Chromium: CVE-2021-30611 Use after free in WebRTC
-
Unscored —
Chromium: CVE-2021-30610 Use after free in Extensions API
-
Unscored —
Chromium: CVE-2021-30609 Use after free in Sign-In
-
Unscored —
Chromium: CVE-2021-30608 Use after free in Web Share
-
Unscored —
Chromium: CVE-2021-30607 Use after free in Permissions
-
Unscored —
Chromium: CVE-2021-30606 Use after free in Blink
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
-
Critical 9.6
Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …
KEV Nov 3, 2021 -
High 8.2
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will alw…
-
Unscored —
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authent…
-
High 8.2
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will a…
-
High 8.2
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction targ…
-
Low 3.1
Improper authorisation of /members discloses room membership to non-members
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability …
-
Low 3.1
Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited t…
-
Unscored —
A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during t…
-
Unscored —
git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may re…
-
High 8.2
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is …
-
High 8.2
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is…
-
Unscored —
Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation…
-
Unscored —
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-…
-
Unscored —
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects…
-
Unscored —
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects…
-
Unscored —
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects…
-
Unscored —
grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned p…
-
Unscored —
long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the …
-
Unscored —
inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant…
-
Unscored —
xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivilege…
-
Unscored —
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by…
-
Unscored —
Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap cor…
-
Unscored —
Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a ma…
-
Unscored —
Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to in…
-
Unscored —
Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the re…
-
Unscored —
Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside…
-
Unscored —
Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside…
-
Unscored —
Use after free in Browser UI in Google Chrome on Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially…
-
Unscored —
Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spo…