Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —
GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted k…
-
Unscored —
A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur whil…
-
Unscored —
An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, …
-
Unscored —
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authen…
-
Unscored —
A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where …
-
Unscored —
An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through …
-
Medium 5.3
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
-
Unscored —
Incorrect operations on the P-224 curve in crypto/elliptic
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
-
Unscored —
Arbitrary code injection via the go command with cgo on Windows in cmd/go
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
-
High 7.8
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privileg…
KEV Apr 6, 2022 -
Unscored —
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw…
-
Unscored —CVE-2020-36221 EPSS 85%
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Asserti…
-
Unscored —CVE-2020-36222 EPSS 77%
A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation,…
-
Unscored —
A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo p…
-
Unscored —
A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing,…
-
Unscored —
A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAu…
-
Unscored —CVE-2020-36228 EPSS 85%
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact As…
-
Unscored —
A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in a…
-
Unscored —CVE-2020-36230 EPSS 12%
A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in dec…
-
Unscored —CVE-2020-36227 EPSS 77%
A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel opera…
-
Unscored —
A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, …
-
Unscored —
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not …
-
Medium 6.5
SAML XML Signature wrapping
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is…
-
Medium 6.5CVE-2021-21239 Public exploit
Open default xmlsec1 key-type preference
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML d…
-
Unscored —
bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin d…
-
Unscored —CVE-2020-25686 Public exploit
A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending…
-
Unscored —CVE-2020-25681 EPSS 84%
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sort…
-
Unscored —CVE-2020-25687 EPSS 89%
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is …
-
Unscored —CVE-2020-25682 EPSS 75%
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract name…
-
Unscored —CVE-2020-25683 EPSS 89%
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is …
-
Unscored —
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the for…
-
Unscored —
A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead…
-
Unscored —
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward…
-
Unscored —
rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending…
-
Critical 9.8CVE-2021-3177 EPSS 24%
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code exec…
-
High 7.5
Directory Traversal in Archive_Tar
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
KEV Aug 25, 2022 -
Unscored —
-
Unscored —
An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certi…
-
High 7.3
Flatpak sandbox escape via spawn portal
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). Th…
-
High 7.2
Loopback bypass in Coturn
Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNEC…