Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exp…
-
Unscored —
Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap c…
-
Medium 5.3
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An at…
-
Unscored —
qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, whi…
-
Unscored —
In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a craf…
-
Low 3.1
A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization che…
-
High 7.5
Helm uses crypto package vulnerable to panic from malformed X.509 certificate
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
-
Unscored —
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a l…
-
Unscored —
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and…
-
Low 3.9
Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the re…
-
Unscored —
Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially ena…
-
Unscored —
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, lead…
-
Low 3.9
Exposure of Sensitive Information to an Unauthorized Actor in Ansible
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advant…
-
Critical 9.8
Improper Input Validation in Twisted
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelin…
-
Critical 9.8
HTTP Request Smuggling in Twisted
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined requ…
-
Medium 5.3
Forced Browsing in Twisted
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers…
-
Medium 5.0
Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp.…
-
Unscored —
In vp8_decode_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation. This cou…
-
Unscored —
In ImageMagick 7.0.9, an out-of-bounds read vulnerability exists within the ReadHEICImageByID function in coders\heic.c…
-
High 7.5
Path Traversal in Ansible
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantag…
-
Unscored —
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file …
-
Unscored —
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in f…
-
Unscored —
usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.
-
High 8.8CVE-2020-9402 EPSS 24%
SQL injection in Django
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on O…
-
Unscored —
WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory c…
-
Unscored —
A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an…
-
Unscored —
When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. Th…
-
Unscored —
By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on…
-
Unscored —
If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these pass…
-
Unscored —
If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution whe…
-
Unscored —
When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location…
-
Unscored —
When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null poi…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some o…
-
Unscored —
Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported fi…
-
High 8.8
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are…
KEV Nov 3, 2021 -
Unscored —
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in …