Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
High 7.5CVE-2019-9517 EPSS 27%
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer…
-
High 7.5CVE-2019-9518 EPSS 25%
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION …
-
Unscored —
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE…
-
High 7.5CVE-2019-9514 EPSS 83%
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depe…
-
Unscored —
In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftIm…
-
Unscored —
In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob f…
-
Critical 9.8
Hashicorp Nomad Access Control Issues
HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.
-
Medium 4.8
heap-buffer-overflow on exif_scan_thumbnail in EXIF extension
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…
-
Medium 4.8
heap-buffer-overflow on exif_process_user_comment in EXIF extension
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…
-
Critical 9.8
SQL Injection in Django
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgre…
-
Unscored —CVE-2019-14745 Public exploit
In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a craf…
-
Unscored —
musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In …
-
High 7.5
Uncontrolled Recursion in Django
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 oc…
-
High 7.5
Django Denial-of-service in strip_tags()
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences…
-
High 8.8
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x …
-
High 8.8
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emu…
-
High 7.8
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to …
-
High 7.5
Django Denial-of-service in django.utils.text.Truncator
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a…
-
Unscored —
nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c…
-
High 8.8
An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially…
-
High 8.8
An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A spec…
-
High 8.8
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A spec…
-
High 8.8
An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A spec…
-
High 7.5
A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding …
-
Low 3.5
A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authori…
-
Low 3.5
A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized us…
-
High 8.8
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSav…
-
Medium 4.6
Exposure of Sensitive Information to an Unauthorized Actor in ansible
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitutio…
-
Low 3.1
A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, exc…
-
Medium 6.5
A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned ta…
-
Critical 9.8
Moby Docker cp broken with debian containers
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
-
Unscored —
canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, an…
-
Unscored —
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relyi…
-
Unscored —
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch fi…
-
Unscored —
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (databa…
-
Unscored —
MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in support.c.
-
Unscored —
A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to w…
-
Unscored —
Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use t…
-
Unscored —
dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allows attackers to cause a denial of service (division by zero)…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is…