CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-11492
https://notcve.org/view.php?id=CVE-2020-11492
An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges. Se detectó un problema en Docker Desktop versiones hasta 2.2.0.5 en Windows. Si un atacante local configura su propia tubería nombrada antes de iniciar Docker con el mismo nombre, este atacante puede interceptar un intento de conexión desde Docker Service (que se ejecuta como SYSTEM) y luego suplantar sus privilegios • https://github.com/CrackerCat/CVE-2020-11492 https://docs.docker.com/docker-for-windows/release-notes https://www.pentestpartners.com/security-blog/docker-desktop-for-windows-privesc-cve-2020-11492 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2020-7606
https://notcve.org/view.php?id=CVE-2020-7606
docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout, fnStderr, fnExit)' uses the variable 'serviceName' which can be controlled by users without any sanitization. docker-compose-remote-api versiones hasta 0.1.4, permite una ejecución de comandos arbitraria. Dentro del archivo "index.js" del paquete, la función "exec(serviceName, cmd, fnStdout, fnStderr, fnExit)" usa la variable "serviceName" que puede ser controlada por los usuarios sin ningún tipo de saneamiento. • https://snyk.io/vuln/SNYK-JS-DOCKERCOMPOSEREMOTEAPI-560125 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-5278
https://notcve.org/view.php?id=CVE-2014-5278
A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs. Se presenta una vulnerabilidad en Docker versiones anteriores a 1.2, por medio de los nombres de los contenedores, que pueden colisionar y anular los ID de los contenedores. • https://github.com/xxg1413/docker-security/tree/master/CVE-2014-5278 https://groups.google.com/forum/#%21topic/docker-announce/lK6fQY6Jy84 https://groups.google.com/forum/message/raw?msg=docker-user/jyf9_mYcMI8/EIZfwe2QNzYJ •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2014-0048
https://notcve.org/view.php?id=CVE-2014-0048
An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways. Se encontró un problema en Docker versiones anteriores a la versión 1.6.0. Algunos programas y scripts en Docker se descargan mediante HTTP y luego ejecutados o usados de manera no segura. • http://www.openwall.com/lists/oss-security/2015/03/24/18 http://www.openwall.com/lists/oss-security/2015/03/24/22 http://www.openwall.com/lists/oss-security/2015/03/24/23 https://access.redhat.com/security/cve/cve-2014-0048 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0048 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0048 https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E https://security&# • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-8179
https://notcve.org/view.php?id=CVE-2014-8179
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation. Docker Engine versiones anteriores a la versión 1.8.3 y CS Docker Engine versiones anteriores a la versión 1.6.2-CS7 no comprueba y extrae apropiadamente el objeto manifiesto desde su representación JSON durante una extracción, lo que permite a atacantes inyectar nuevos atributos en un objeto JSON y omitir la comprobación pull-by-digest. • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7 https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12 https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ https://www.docker.com/legal/docker-cve-database • CWE-20: Improper Input Validation •