Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
High 7.8
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_…
-
Unscored —
GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.
-
High 7.5
A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain reques…
-
Medium 5.3
A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with t…
-
Unscored —
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…
-
Medium 6.5
SaltStack Salt is vulnerable Arbitrary Directory Access
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
KEV Nov 3, 2021 -
Critical 9.8
SaltStack Salt Unauthenticated Remote Code Execution
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be u…
KEV Nov 3, 2021 -
Medium 5.2
Path Traversal in Ansible
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could tak…
-
Medium 6.9
Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…
KEV Jan 23, 2025 -
Medium 6.9
jQuery has a potential XSS vulnerability
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…
-
High 7.5CVE-2020-10663 Public exploit
Unsafe object creation in json RubyGem
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…
-
Unscored —
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denia…
-
Unscored —
HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a…
-
Unscored —
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_M…
-
Unscored —
An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. …
-
High 7.5
OOB Read in urldecode()
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array i…
-
Unscored —
An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet usin…
-
Unscored —
jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
-
High 8.1CVE-2020-6819 Exploited
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are a…
KEV Nov 3, 2021 -
High 8.1CVE-2020-6820 Exploited
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of …
KEV Nov 3, 2021 -
Unscored —
When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method…
-
Unscored —
On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDeco…
-
Unscored —
A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, …
-
Unscored —
Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing…
-
Unscored —
Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some…
-
Unscored —
Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefo…
-
Critical 9.3
Authentication bypass MinIO Admin API
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without know…
-
Unscored —CVE-2020-11945 EPSS 27%
An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to ga…
-
Medium 5.8
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This fla…
-
High 7.5
libslirp: use after free vulnerability cause a denial of service.
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
-
Medium 4.0
Malicious URLs can still cause Git to send a stored credential to the wrong server
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an expl…
-
High 7.5
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Cep…
-
High 7.5
Segmentation fault in SSL_check_chain
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an i…
-
Unscored —
re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.
-
Unscored —
A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allo…
-
Unscored —
An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpres…
-
Unscored —
An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESICo…
-
Medium 5.3
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions t…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…