Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —
Local symlink attack in Unbound and NSD
NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not t…
-
Unscored —
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only re…
-
Unscored —CVE-2020-29599 Public exploit
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a passw…
-
Unscored —
hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
-
High 8.8
An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML we…
-
Unscored —
A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this…
-
Medium 6.1
lxml vulnerable to Cross-site Scripting
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML…
-
High 8.8
A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted we…
-
Unscored —
A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This fi…
-
Medium 4.3
A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to …
-
Unscored —
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB reque…
-
Unscored —
A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC …
-
Medium 5.2CVE-2020-15257 Public exploit
containerd-shim API Exposed to Host Network Containers
containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s AP…
-
Unscored —
ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to …
-
Unscored —
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
-
Unscored —
A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a spec…
-
Unscored —
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even i…
-
Unscored —
slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even …
-
Unscored —
scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.
-
Medium 5.3CVE-2020-26235 Public exploit
Segmentation fault in Rust time crate
In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the …
-
Unscored —
An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 971…
-
Unscored —
In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source charact…
-
Unscored —
An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corru…
-
Medium 6.5
Path Traversal in HashiCorp Nomad
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
-
High 7.5
Denial of service attack due to invalid JSON
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such…
-
Unscored —
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not v…
-
Unscored —
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, bef…
-
Unscored —
Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's in…
-
Medium 5.0
In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3Glyp…
-
Unscored —
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may …
-
High 8.8
Drupal core Unrestricted Upload of File with Dangerous Type
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupa…
KEV Jan 18, 2022 -
Unscored —
Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.
-
High 7.8
Multiple vulnerabilities through filename manipulation in Archive_Tar
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
-
High 7.8
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…
KEV Aug 25, 2022 -
Unscored —
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…
-
Unscored —
Panic during division of very large numbers in math/big
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
-
Unscored —
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
-
Unscored —
Arbitrary code execution via the go command with cgo in cmd/go
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
-
High 7.3CVE-2020-7774 EPSS 70%
Prototype Pollution
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
-
Unscored —CVE-2020-25695 EPSS 46%
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before …