Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Critical 9.8
PCX P mode buffer overflow in Pillow
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
-
High 7.1
Out-of-bounds Read in Pillow
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.
-
Medium 5.7
Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would disclos…
-
High 7.4
Improper Verification of Cryptographic Signature in Pure-Python ECDSA
A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verificatio…
-
Unscored —
The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial …
-
Unscored —
An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted …
-
Unscored —
A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.
-
High 7.1
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially cra…
-
High 7.5
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
-
Unscored —
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.
-
Unscored —
In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to …
-
Unscored —
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, rela…
-
Medium 4.8
Use-after-free in exif parsing under memory sanitizer
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer.…
-
Medium 4.8
Heap-buffer-overflow READ in exif
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer.…
-
Low 3.7
DirectoryIterator class silently truncates after a null byte
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths…
-
Unscored —
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer thr…
-
Unscored —
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer thr…
-
Unscored —
An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows…
-
Unscored —
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial o…
-
High 7.1
HTTP Request Smuggling: LF vs CRLF handling in Waitress
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding C…
-
High 7.1
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding sh…
-
Unscored —CVE-2019-19905 Public exploit
NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration …
-
Unscored —
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in Op…
-
High 7.5
Singularity insecure permissions
Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.
-
Unscored —
An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15…
-
Critical 9.8
Django Potential account hijack via password reset form
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a pa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —CVE-2019-8820 Public exploit
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.1 and iPa…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPa…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1,…