Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Medium 5.3
Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…
-
Unscored —
HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did no…
-
Unscored —
In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.
-
High 7.5
REXML round-trip instability
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
-
Unscored —
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fi…
-
Medium 6.1CVE-2020-25864 Scanner template
HashiCorp Consul Cross-site Scripting vulnerability
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
-
Unscored —
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a cont…
-
Unscored —
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
-
Unscored —
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska …
-
Unscored —
Out-of-bounds read in Exiv2::Internal::CrwMap::encode
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write m…
-
Unscored —
Heap buffer overflow in Exiv2::Jp2Image::doWriteMetadata
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metad…
-
High 7.8
Adobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code execution
Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution i…
-
High 7.8
Adobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code execution
Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution i…
-
Unscored —
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KE…
-
Unscored —
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS)…
-
Unscored —
In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialize…
-
Unscored —
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the el…
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
Unscored —
Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised t…
-
Unscored —
Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially explo…
-
Unscored —
Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the ren…
-
Unscored —
Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potent…
-
Unscored —
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corr…
-
Unscored —
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially explo…
-
Medium 4.0
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network inter…
-
Unscored —
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size pr…
-
High 7.5
Clam AntiVirus (ClamAV) Email Parser Denial of Service Vulnerability
A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffe…
-
High 7.5
Clam AntiVirus (ClamAV) PDF Parser Denial of Service Vulnerability
A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to im…
-
High 7.5
Clam AntiVirus (ClamAV) Excel XLM Parser Denial of Service Vulnerability
A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to im…
-
Unscored —
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code…
-
Medium 6.5
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted …
-
Medium 4.3
View name validation bypass in Jenkins
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.
-
Medium 4.3
Lack of type validation in agent related REST API in Jenkins
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one …
-
Unscored —
GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is relat…
-
Unscored —
fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Director…
-
High 7.5
Crash due to malformed relay protocol message
Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the sa…
-
Medium 5.5
Improper input validation in umoci
Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.
-
Medium 5.3
Directory Traversal in Django
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
-
Unscored —
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, E…