Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —
Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform…
-
Unscored —
Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded pa…
-
High 7.5
Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or craft…
-
Unscored —
Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had…
-
Unscored —
Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially ex…
-
Unscored —
Heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised t…
-
Unscored —
Use after free in File API in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit hea…
-
Unscored —
Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corr…
-
Unscored —
Use after free in Notifications in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised t…
-
Unscored —
Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap co…
-
Unscored —
Heap buffer overflow in Media Feeds in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to…
-
Unscored —
aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.
-
High 7.4
Invalid session token expiration
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fi…
-
Unscored —
dwa_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc_count is not strictly …
-
High 7.5
Redis vulnerability in STRALGO LCS on 32-bit systems
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially …
-
Unscored —
A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulati…
-
High 7.5
Uncontrolled Resource Consumption in Pillow
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a li…
-
Medium 5.5
Insufficient Verification of Data Authenticity in Pillow
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
-
Critical 9.1
Pillow Out-of-bounds Read vulnerability
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
-
Critical 9.1
Out-of-bounds Read in Pillow
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
-
Unscored —
A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection …
-
Medium 5.5
GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
-
Medium 5.5
Pillow denial of service
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
-
Unscored —
An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions…
-
Unscored —
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versi…
-
Unscored —
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and incl…
-
Unscored —
A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions befor…
-
Unscored —
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger …
-
High 7.5
Potential infinite loop in Pillow
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
-
Unscored —
aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
-
Unscored —
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_fil…
-
Unscored —
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_v4l2_m2m_create_context function …
-
Unscored —
A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.
-
Unscored —
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from …
-
Unscored —
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. Whil…
-
Medium 6.3
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the conta…
-
Unscored —
A flaw was found in gdk-pixbuf in versions before 2.42.0. An integer wraparound leading to an out of bounds write can o…
-
Unscored —
A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a d…
-
Unscored —
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0…
-
Unscored —
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.…