Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 333
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
go 202
curl 196
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
postgresql15 150
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
dotnet8-runtime 128
dotnet9-runtime 114
bind 114
postgresql16 109
dotnet10-runtime 109
postgresql17 106
py3-django 106
tiff 100
freerdp 100
postgresql18 98
openjdk21 97
wolfssl 97
samba 92
xorg-server 87
imagemagick6 85
qemu 85
nodejs-current 84
10,741 results · Feed
-
Critical 9.8
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes d…
-
High 7.8
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead t…
-
Unscored —
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password…
-
Unscored —
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificati…
-
Unscored —
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
-
High 7.5
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildca…
-
Low 3.7
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP ad…
-
Unscored —
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), eve…
-
Low 3.1
Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injec…
-
Medium 4.2
Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial o…
-
Low 3.1
Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet inject…
-
Low 3.1
Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted captur…
-
Unscored —
An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be…
-
Medium 6.5
Denial of service attack via incorrect parameters to federation APIs
Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the p…
-
Unscored —
When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended …
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed ev…
-
Unscored —
When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into i…
-
Unscored —
Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a…
-
Unscored —
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field…
-
Unscored —
If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, …
-
Unscored —
Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by i…
-
Unscored —
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populate…
-
Unscored —
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do no…
-
Unscored —
If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointer…
-
Unscored —
During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-aft…
-
Unscored —
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached throu…
-
Unscored —
OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in …
-
Unscored —
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to …
-
Unscored —
When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequen…
-
Unscored —
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file…
-
Unscored —
It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possib…
-
Unscored —
Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially…
-
Unscored —
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitizat…
-
Unscored —
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable…
-
Unscored —
A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue co…
-
Unscored —
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watc…
-
Unscored —
A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and …
-
Medium 5.9CVE-2020-1971 Public exploit
EDIPARTYNAME NULL pointer dereference
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…
-
Unscored —
A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming…