Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A craf…
-
Unscored —CVE-2020-10543 EPSS 11%
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifier…
-
Medium 6.3
Kubernetes kube-controller-manager SSRF
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary in…
-
Unscored —
Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a c…
-
Unscored —
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which al…
-
Unscored —
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the en…
-
Unscored —
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index va…
-
High 7.7
Improper Restriction of XML External Entity Reference
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
-
Unscored —
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TL…
-
Unscored —
libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed P…
-
Medium 5.8
Server Side Request Forgery in Grafana
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to…
-
Medium 6.0CVE-2020-10749 Public exploit
containernetworking/plugins vulnerable to MitM attacks
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IP…
-
Medium 6.1
XSS in Django
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
-
Medium 5.9CVE-2020-13254 Public exploit
Data leakage via cache key collision in Django
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
-
Low 3.7
Denial of service in nghttp2
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…
-
Unscored —
ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) …
-
Medium 6.0CVE-2020-13401 Public exploit
Improper Input Validation in Docker Engine
An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.
-
Unscored —
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x …
-
Unscored —
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
-
Unscored —
A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected t…
-
Unscored —
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queu…
-
Unscored —
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which…
-
Unscored —
In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the …
-
Unscored —
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.
-
Unscored —
A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corrupti…
-
Unscored —
A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a po…
-
Unscored —
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Not…
-
Unscored —
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Not…
-
Unscored —
Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability …
-
Unscored —
Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed …
-
Unscored —
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can …
-
Unscored —
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be …
-
Unscored —
A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by se…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some o…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed e…
-
Unscored —
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
-
Unscored —
SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
-
Unscored —
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address …
-
Unscored —
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_re…
-
Unscored —CVE-2020-13398 Public exploit
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto…