Ecosystem
Wolfi
8,518 known vulnerabilities.
Most affected packages
8,494 results · Feed
-
High 8.1
Missing Encryption of Sensitive Data in yarn
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
-
Unscored —
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch fi…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versio…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported version…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported version…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versio…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected…
-
Unscored —
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affec…
-
Unscored —
stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 thr…
-
Medium 5.9
Golang/x/crypto message forgery vulnerability
A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or m…
-
Medium 5.9
golang.org/x/crypto/salsa20/salsa uses insufficiently random values
An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa package…
-
Unscored —CVE-2019-2684 EPSS 38%
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported version…
-
Medium 6.1
Improper Neutralization of Input During Web Page Generation in Select2
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
-
High 7.4
HashiCorp Consul vulnerable to Origin Validation Error
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.
-
Unscored —
libvterm through 0+bzr726, as used in Vim and other products, mishandles certain out-of-memory conditions, leading to a…
-
Medium 5.3
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called un…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Networking). Supported versions that are affect…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affecte…
-
Medium 6.5
Apache Thrift Node.js static web server sandbox escape
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.
-
High 7.5
Improper Input Validation in Apache Thrift
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be di…
-
Medium 5.9
HashiCorp Consul can use cleartext agent-to-agent RPC communication
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE). Supported ver…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Scripting). Supporte…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported ver…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions …
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Sound). The supported version that is affected …
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versio…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Utility). The supported version that is affecte…
-
High 7.5
It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate cer…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported version that is affect…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JSSE). Supported versions tha…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported version…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected a…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Suppor…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affect…
-
Medium 5.4CVE-2018-8024 Scanner template
Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark via crafted URL
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to e…
-
Low 3.7
Regular Expression Denial of Service in debug
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.