Ecosystem
Alpine
10,780 known vulnerabilities.
Most affected packages
10,741 results · Feed
-
Unscored —
A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for…
-
Unscored —
POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScri…
-
Unscored —
Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or Jav…
-
Unscored —
A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called di…
-
Unscored —
Reflected XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view …
-
Unscored —
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get…
-
Medium 5.3
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called un…
-
Medium 6.8
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (…
-
Medium 5.9
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses w…
-
Unscored —CVE-2018-17189 EPSS 19%
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the …
-
Unscored —CVE-2018-17199 EPSS 20%
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the sess…
-
Unscored —CVE-2019-0190 EPSS 60%
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request…
-
Low 3.7
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of respons…
-
Medium 5.4
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied…
-
Unscored —
In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attack…
-
Unscored —
An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elf…
-
Unscored —
An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf3…
-
Unscored —
A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils …
-
Unscored —
A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to exe…
-
Unscored —
A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker …
-
Unscored —
A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinde…
-
Unscored —
The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, …
-
Unscored —
gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch func…
-
Critical 9.8
phpMyAdmin SQL injection in Designer feature
An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.
-
Medium 5.9
phpMyAdmin Arbitrary file read vulnerability
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to…
-
Unscored —
murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the dat…
-
Unscored —
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in…
-
Unscored —
An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/in…
-
Unscored —
Denial of service affecting P-521 and P-384 curves in crypto/elliptic
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.
-
Unscored —
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attac…
-
Unscored —
sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv.
-
Medium 5.9CVE-2018-5737 EPSS 11%
BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled.
A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative…
-
High 7.5
A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes…
-
Medium 6.5
Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation
To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending…
-
Unscored —CVE-2018-5736 EPSS 18%
An error in zone database reference counting can lead to an assertion failure if a server which is running an affected …
-
Medium 5.3CVE-2018-5738 EPSS 11%
Some versions of BIND can improperly permit recursive query service to unauthorized clients
Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an …
-
Medium 5.9CVE-2018-5733 EPSS 20%
A malicious client can overflow a reference counter in ISC dhcpd
A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3…
-
High 7.5CVE-2017-3145 EPSS 28%
Improper fetch cleanup sequencing in the resolver can cause named to crash
BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9…
-
High 7.5
An error in TSIG authentication can permit unauthorized dynamic updates
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BI…
-
High 7.5
A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME
Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurre…