Ecosystem
Azure Linux
13,280 known vulnerabilities.
Most affected packages
4,316 results · Clear filters · Feed
-
High 7.5
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…
-
High 7.8CVE-2023-3390 Public exploit
Use-after-free in Linux kernel's netfilter subsystem
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vu…
-
High 7.8
Use after free in io_uring in the Linux Kernel
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac5…
-
High 7.8
Out-of-bounds write in Linux kernel's ipvlan network driver
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is r…
-
High 7.1
A use-after-free flaw was found in mt7921_check_offload_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c …
-
High 7.5
Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0
If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a st…
-
High 7.5
Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled
A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue a…
-
High 7.5
named's configured cache size limit can be significantly exceeded
Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size`…
-
High 7.5
A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, dur…
-
High 7.0CVE-2023-35828 Public exploit
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/…
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/…
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/medi…
-
High 7.8CVE-2023-35788 Public exploit
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an o…
-
High 7.1
An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c …
-
High 8.8
libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.
-
High 7.1
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. Thi…
-
High 7.8
Unsafe behavior in setuid/setgid binaries in runtime
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/set…
-
High 7.8CVE-2023-2603 Public exploit
A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer over…
-
High 7.8
A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. …
-
High 8.7
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify th…
-
High 7.5
OpenPrinting CUPS vulnerable to heap buffer overflow
OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` …
-
High 7.8CVE-2023-2598 Public exploit
A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the …
-
High 7.1
A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verif…
-
High 7.5
A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() functio…
-
High 7.5
pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthentica…
-
High 7.5
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's pub…
-
High 7.5
0-byte UDP payload DoS in c-ares
c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously i…
-
High 7.8
sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists …
-
High 7.8
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do_directive at /nasm/nasm-pp.…
-
High 7.8
In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error…
-
High 7.3
Improper sanitization of CSS values in html/template
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, i…
-
High 7.3
Improper handling of empty HTML attributes in html/template
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
-
High 7.8
yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. Note: Mu…
-
High 7.8
Integer Overflow or Wraparound in vim/vim
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.
-
High 7.8
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.
-
High 7.8
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused…
-
High 7.5CVE-2023-30861 Public exploit
Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` he…
-
High 7.8
Use-after-free in Linux kernel's Performance Events subsystem
A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remo…
-
High 8.1
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
-
High 8.1
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS …