Ecosystem
Wolfi
8,518 known vulnerabilities.
Most affected packages
8,494 results · Feed
-
Unscored —
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a…
-
Medium 5.9
Denial of Service in Google Guava
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (w…
-
High 8.3
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). The supported version that is affec…
-
Unscored —CVE-2018-2799 EPSS 15%
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported ver…
-
High 8.3
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). The supported version that is affec…
-
Medium 5.3
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supp…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions …
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Install). Supported versions that are affected …
-
Low 3.1
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions…
-
Medium 5.3
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported vers…
-
Unscored —
Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported vers…
-
Medium 5.3
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Suppor…
-
Unscored —
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR…
-
Medium 5.5
DNS Rebinding in etcd
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
-
Unscored —
An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer deref…
-
Unscored —
A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.
-
Unscored —
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-comm…
-
Unscored —
Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome,…
-
Unscored —
php-fpm allows local users to write to or create arbitrary files via a symlink attack.
-
Unscored —
HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network.
-
Low 3.1
Kubernetes in OpenShift3 Access Control Misconfiguration
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.
-
Unscored —
rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by rea…
-
Unscored —
click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which all…
-
Medium 4.6
chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TI…
-
Unscored —CVE-2016-7153 EPSS 13%
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content leng…
-
Unscored —
libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Applianc…
-
Critical 9.8
Authorization bypass in Openshift
Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
-
High 7.7
Access Restriction Bypass in kubernetes
The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.
-
Medium —
Integer Overflow or Wraparound in JBCrypt
Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum expon…
-
Medium —
Improper Control of Generation of Code in HawtJNI
Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predic…
-
Medium —
Improper Certificate Validation in Apache Commons HttpClient
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certif…
-
Unscored —
The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HI…
-
Unscored —
plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty …
-
Unscored —
Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch function and an …
-
Unscored —
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to g…
-
Unscored —
Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to …
-
Unscored —
Unspecified vulnerability in GraphicsMagick before 1.2.3 allows remote attackers to cause a denial of service (crash) v…
-
Unscored —
The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNativeWrappers" and e…