Ecosystem
Azure Linux
13,280 known vulnerabilities.
Most affected packages
560 results · Clear filters · Feed
-
Low 3.2
Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigge…
-
Low 2.2
Undefined Behavior for Input to API in Mutt
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
-
Low 3.4
Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviled…
-
Low 3.3
Qemu: 9pfs: suid/sgid bits not dropped on file write
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw cou…
-
Low 2.6
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generato…
-
Low 3.1
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that …
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…
-
Low 3.3
A segmentation fault flaw was found in the Advancecomp package. This may lead to decreased availability.
-
Low 3.1
etcd key name can be accessed via LeaseTimeToLive API
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read p…
-
Low 3.3
yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. Note: Multi…
-
Low 3.3
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized…
-
Low 3.1
wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64
wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the in…
-
Low 2.6
Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie l…
-
Low —
ReDoS based DoS vulnerability in Action Dispatch
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, whe…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Low 3.3
Buildah (as part of Podman) vulnerable to Path Traversal
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
-
Low 3.1CVE-2022-39379 EPSS 45%
Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary …
-
Low 3.1
Redis Crash Report debug.c sigsegvHandler denial of service
** DISPUTED ** A vulnerability, which was classified as problematic, was found in Redis up to 6.2.7/7.0.5. Affected is the function sigsegvHandler of the file debug.c of the component Crash Report. The manipulation leads to denial of service. The complexity o…
-
Low 3.5
Linux Kernel BPF libbpf.c find_prog_by_sec_insn null pointer dereference
A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to…
-
Low 3.9
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are a…
-
Low 3.5
Linux Kernel CIFS sess.c sess_free_buffer double free
A vulnerability was found in Linux Kernel. It has been rated as problematic. Affected by this issue is the function sess_free_buffer of the file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads to double free. It is recommended to apply a …
-
Low 3.5
Linux Kernel BPF af_unix.c unix_release_sock memory leak
A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak. It is reco…
-
Low 3.5
X.org Server xquartz X11Controller.m denial of service
A vulnerability, which was classified as problematic, was found in X.org Server. This affects an unknown part of the file hw/xquartz/X11Controller.m of the component xquartz. The manipulation leads to denial of service. It is recommended to apply a patch to f…
-
Low 3.5
Linux Kernel BlueZ mgmt-tester.c read_50_controller_cap_complete null pointer dereference
A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereferen…
-
Low 3.5
Linux Kernel Netfilter sysfs.c damon_sysfs_add_target memory leak
A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to memory leak. It is recommended to apply a patch…
-
Low 3.5
X.org Server xkb.c ProcXkbGetKbdByName memory leak
A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue…
-
Low 3.5
Linux Kernel BPF usdt.c parse_usdt_arg memory leak
A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommende…
-
Low 2.6
Linux Kernel kcm kcmsock.c kcm_tx_work race condition
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch …
-
Low 3.7
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …
-
Low 3.1
Session tickets lack random ticket_age_add in crypto/tls
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
-
Low 3.3
drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency…
-
Low 3.3
A Malformed Lua script can crash Redis
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem i…
-
Low 3.9
Lua scripts can be manipulated to overcome ACL rules in Redis
Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privil…
-
Low 2.9
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 2.9
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 2.9
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 3.4
A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly …
-
Low 3.7
An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but…
-
Low 2.6
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
-
Low 2.2
Bypass of Kubernetes API Server proxy TOCTOU
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part…