Ecosystem
Alpine
10,696 known vulnerabilities.
Most affected packages
10,657 results · Feed
-
Low 3.6
Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite
Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call…
-
Unscored —
Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information …
-
Unscored —
Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence…
-
Unscored —
When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a …
-
Unscored —
Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could b…
-
Unscored —
Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefo…
-
Unscored —
The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission pro…
-
Unscored —
On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak …
-
Unscored —
It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to …
-
Medium 6.5
PowerShell Information Disclosure Vulnerability
PowerShell Information Disclosure Vulnerability
-
Medium 6.2
Imagemagick: heap use-after-free in coders/bmp.c
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
-
Low 3.9
Use-After-Free in win_close() in vim
Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which…
-
Medium 6.3
Out-of-bounds Read in Wireshark
SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file
-
High 7.4
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
-
Unscored —
Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote a…
-
Unscored —CVE-2023-6112 EPSS 25%
Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit …
-
Unscored —
Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially …
-
Medium 5.0
Generic Extractor MITM Vulnerability in yt-dlp
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP sessio…
-
Medium 6.2
ASP.NET Core Security Feature Bypass Vulnerability
ASP.NET Core Security Feature Bypass Vulnerability
-
High 7.6
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
-
High 8.8CVE-2023-23583 Public exploit
Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated…
-
Unscored —
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execu…
-
High 7.5
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigge…
-
Unscored —
Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit he…
-
High 7.5
Samba: ad dc password exposure to privileged users and rodcs
A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to acces…
-
Low 3.1
Possible endless data attack from attacker-controlled registry in cosign
Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Co…
-
High 8.8
Out-of-bounds write in exiv2
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, s…
-
Medium 5.4
Opensc: multiple memory issues with pkcs15-init (enrollment tool)
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the…
-
Medium 6.6
Opensc: potential pin bypass when card tracks its own login state
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, par…
-
Medium 4.5
Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card…
-
Medium 5.3
Excessive time spent in DH check / generation with large Q parameter value
Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…
-
Medium 6.5
Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" ser…
-
Critical 9.1
Samba: smbd allows client access to unix domain sockets on the file system as root
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR…
-
High 8.6CVE-2023-46847 EPSS 79%
Squid: denial of service in http digest authentication
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.
-
High 8.6CVE-2023-46848 EPSS 11%
Squid: denial of service in ftp
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
-
Medium 6.5
Samba: ad dc busy rpc multiple listener dos
A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non…
-
Medium 6.5
Samba: smb clients can truncate files with read-only permissions
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files …
-
Critical 9.3
Squid: request/response smuggling in http/1.1 and icap
SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.
-
Unscored —
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-…
-
Medium 5.3
Django Denial of service vulnerability in django.utils.encoding.uri_to_iri
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.