Ecosystem
Wolfi
8,505 known vulnerabilities.
Most affected packages
559 results · Clear filters · Feed
-
Low 3.7
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos …
-
Low 2.6
Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie l…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Su…
-
Low 3.5
davidmoreno onion Log response.c onion_response_flush allocation of resources
A vulnerability was found in davidmoreno onion. It has been rated as problematic. Affected by this issue is the function onion_response_flush of the file src/onion/response.c of the component Log Handler. The manipulation leads to allocation of resources. The…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Sup…
-
Low 2.7
Jetty invalid URI parsing may produce invalid HttpURI.authority
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failu…
-
Low 3.5
Angular Comment cross site scripting
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an …
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serializat…
-
Low 3.0
ANSI escape characters in kubectl output are not being filtered
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
-
Low 3.7
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …
-
Low 2.9
Hashicorp Vault Privilege Escalation Vulnerability
HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Ente…
-
Low 2.8
`docker cp` allows unexpected chmod of host files
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for ex…
-
Low 3.1
Holes in EndpointSlice Validation Enable Host Network Hijack
A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.
-
Low 3.1
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supp…
-
Low 3.3
Temp directory permission issue in Guava
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on un…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 3.1
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 3.1
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions…
-
Low 2.5
In-band key negotiation issue in AWS S3 Crypto SDK for GoLang
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to c…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are…
-
Low 3.7
Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are J…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are a…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that…
-
Low 3.7
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions tha…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions tha…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions…
-
Low 3.7
Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions…
-
Low 3.7
Regular Expression Denial of Service in debug
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
-
Low 3.1
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions…
-
Low 3.1
Kubernetes in OpenShift3 Access Control Misconfiguration
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.