Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —CVE-2020-14372 Public exploit
A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Se…
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line i…
-
Unscored —
A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an …
-
High 7.5
Pillow Denial of Service by Uncontrolled Resource Consumption
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
-
High 7.5
Pillow Uncontrolled Resource Consumption
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
-
High 7.5
Pillow Denial of Service by Uncontrolled Resource Consumption
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
-
Unscored —
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.…
-
Critical 9.8CVE-2021-3197 EPSS 72%
SaltStack Salt is vulnerable to shell injection via ProxyCommand argument
An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
-
Critical 9.1
SaltStack Salt eauth tokens can be used once after expiration
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
-
Critical 9.8
SaltStack Salt command injection in the Salt-API when using the Salt-SSH client
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.p…
-
Critical 9.8CVE-2021-25283 EPSS 10%
SaltStack Salt Server Side Template Injection
An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
-
Medium 4.4
SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
-
Critical 9.8
SaltStack Salt Improper Authentication vulnerability
An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
-
Critical 9.1
SaltStack Salt Directory Traversal vulnerability
An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.
-
High 7.5
A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision…
-
Medium 5.4
Integer overflow on 32-bit systems
Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 o…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed ev…
-
Unscored —
Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to rea…
-
Unscored —
When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user i…
-
Unscored —
If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin informati…
-
Unscored —
Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading…
-
Unscored —
The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to …
-
Unscored —
An ambiguous file picker design could have confused users who intended to select and upload a single file into uploadin…
-
Unscored —
Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: Th…
-
Unscored —
The browser could have been confused into transferring a screen sharing state into another tab, which would leak uninte…
-
Unscored —
An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the addr…
-
Unscored —
Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially ex…
-
Unscored —
Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an i…
-
Unscored —
Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable cra…
-
Unscored —
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reporte…
-
Unscored —
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure th…
-
Unscored —
Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded was…
-
Unscored —
When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Polic…
-
Unscored —
One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.co…
-
Unscored —
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the conte…
-
Unscored —
The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to …
-
Unscored —
The developer page about:memory has a Measure function for exploring what object types the browser has allocated and th…