Skip to content
OpenAdvisories

Ecosystem

Azure Linux

13,277 known vulnerabilities.

Most affected packages

kernel 6,741 mysql 401 vim 200 golang 193 rust 160 nodejs 142 wireshark 141 tensorflow 121 telegraf 115 cri-o 105 podman 100 curl 99 python-tensorboard 94 httpd 94 python3 93 hyperv-daemons 92 openjpeg2 85 js-jquery 82 cmake 81 thrift 80 buildah 79 rabbitmq-server 78 samba 78 qemu 77 libtiff 77 openssl 77 python-py 76 kubernetes 74 packer 74 kubevirt 73 xorg-x11-server 72 hdf5 72 bind 69 cert-manager 68 keda 68 moby-engine 68 kata-containers 67 libsoup 64 php 63 unbound 62
All Critical High Medium Low Exploited only Public exploit

293 results · Clear filters · Feed

  • High 7.5
    CVE-2021-32675 Public exploit EPSS 16%

    DoS vulnerability in Redis

    Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.4
    CVE-2021-3712 Public exploit EPSS 48%

    Read buffer overruns processing ASN.1 strings

    ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  • High 7.8
    CVE-2021-38185 Public exploit

    GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_…

    cpio cpio cpio cpio Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2021-23840 Public exploit EPSS 51%

    Integer overflow in CipherUpdate

    Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  • High 7.2
    CVE-2021-23337 Public exploit Scanner template EPSS 20%

    Command Injection

    Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

    js-jquery lodash node-lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems
  • High 7.3
    CVE-2020-28458 Public exploit

    Prototype Pollution

    All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

    reaper datatables.net Azure Linux npm
  • High 7.5
    CVE-2020-17527 Public exploit EPSS 25%

    Apache Tomcat: Request header mix-up between HTTP/2 streams

    While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated wi…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Azure Linux Maven
  • High 7.5
    CVE-2020-26160 Public exploit

    Authorization bypass in github.com/dgrijalva/jwt-go

    jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if th…

    gitness dgraph docker-credential-acr-env gitea Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.4
    CVE-2020-8203 Public exploit

    Prototype Pollution in lodash

    Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

    js-jquery lodash node-lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems
  • High 8.6
    CVE-2020-4040 Public exploit

    CSRF issue on preview pages in Bolt CMS

    Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of p…

    bolt bolt bolt/bolt bolt Azure Linux Packagist
  • High 7.5
    CVE-2019-20149 Public exploit

    Validation Bypass in kind-of

    ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate…

    js-jquery kind-of node-kind-of node-kind-of Debian Ubuntu Azure Linux npm
  • High 7.5
    CVE-2019-0205 Public exploit

    Loop with Unreachable Exit Condition in Apache Thrift

    In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects o…

    Apache Apache Thrift druid trino Debian Azure Linux Wolfi Maven
  • High 8.4
    CVE-2013-2094 Exploited Public exploit EPSS 48%

    The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data …

    linux kernel Debian Azure Linux
    KEV Sep 15, 2022