Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Medium 4.4
Information disclosure in JUnit4
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files a…
-
Unscored —
When converting coordinates from projective to affine, the modular inversion was not performed in constant time, result…
-
Unscored —
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication …
-
Unscored —
In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that tr…
-
Unscored —
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display syst…
-
Unscored —
In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was ad…
-
Unscored —
In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was a…
-
Unscored —
In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a b…
-
Unscored —
In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in…
-
Unscored —
pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might no…
-
Unscored —
hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide…
-
Unscored —
The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_rea…
-
Unscored —
The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15em…
-
Unscored —
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.
-
Unscored —CVE-2020-25637 Public exploit
A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting …
-
High 7.5CVE-2020-25613 Public exploit
WEBRick vulnerable to HTTP Request/Response Smuggling
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…
-
Medium 4.3
PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such p…
-
Medium 5.4
Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect en…
-
Unscored —
fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the curre…
-
Unscored —
An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to inse…
-
Unscored —
Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a d…
-
High 7.5
Code injection in Apache Ant
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said prot…
-
Unscored —
If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from th…
-
Unscored —
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access …
-
Unscored —
Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. …
-
Unscored —
When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) wa…
-
Unscored —
When processing a MAR update file, after the signature has been validated, an invalid name length could result in a hea…
-
Unscored —
A lock was missing when accessing a data structure and importing certificate information into the trust database. This …
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corr…
-
Unscored —
When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially e…
-
Unscored —
Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaSc…
-
Unscored —
By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the dow…
-
Unscored —
When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential …
-
Critical 9.8
Token leases could outlive their TTL in HashiCorp Vault
HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.
-
High 7.5CVE-2020-26160 Public exploit
Authorization bypass in github.com/dgrijalva/jwt-go
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if th…
-
Unscored —
url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC fi…
-
Medium 6.5
CRLF injection in urllib3
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
-
Unscored —
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.