CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38730
https://notcve.org/view.php?id=CVE-2022-38730
27 Apr 2023 — Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..\dataRoot\network\files\local-kv.db because of a TOCTOU race condition. • https://docs.docker.com/desktop/release-notes/#docker-desktop-460 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-1802 – In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed
https://notcve.org/view.php?id=CVE-2023-1802
06 Apr 2023 — In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected. In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted net... • https://docs.docker.com/desktop/release-notes/#4180 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0629 – Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers
https://notcve.org/view.php?id=CVE-2023-0629
13 Mar 2023 — Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket). The affected func... • https://docs.docker.com/desktop/release-notes/#4170 • CWE-424: Improper Protection of Alternate Path CWE-501: Trust Boundary Violation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0628 – Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL
https://notcve.org/view.php?id=CVE-2023-0628
13 Mar 2023 — Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL. • https://docs.docker.com/desktop/release-notes/#4170 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.4EPSS: 0%CPEs: 3EXPL: 0CVE-2021-44719
https://notcve.org/view.php?id=CVE-2021-44719
25 May 2022 — Docker Desktop 4.3.0 has Incorrect Access Control. Docker Desktop versión 4.3.0, presenta un Control de Acceso Incorrecto • https://docs.docker.com/desktop/mac/release-notes •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-26659
https://notcve.org/view.php?id=CVE-2022-26659
25 Mar 2022 — Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docker Desktop installer, when run elevated, will write its log files to a location not writable by non-administrator users. El instalador de Docker Desktop en Windows en versiones anteriores a 4.6.0, permite a un atacante sobrescribir cualquier archivo escribible por el admini... • https://docs.docker.com/desktop/windows/release-notes • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23774 – Docker Desktop Link Following Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-23774
01 Feb 2022 — Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files. Docker Desktop versiones anteriores a 4.4.4 en Windows, permite a atacantes mover archivos arbitrarios This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Docker Desktop Service. By crea... • https://docs.docker.com/docker-for-windows/release-notes •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-45449
https://notcve.org/view.php?id=CVE-2021-45449
12 Jan 2022 — Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files. Docker Desktop versiones 4.3.0 y 4.3.1, presenta un bug que puede registrar información confidencial (token de acceso o contraseña) en la máquina del usuario durante... • https://docs.docker.com/desktop/windows/release-notes • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-37841
https://notcve.org/view.php?id=CVE-2021-37841
12 Aug 2021 — Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with low privilege to read, write and possibly even execute code inside the containers. Docker Desktop versiones anteriores a 3.6.0, sufre de un control de acceso incorrecto. Si una cuenta poco privilegiada es capaz de a... • https://docs.docker.com/docker-for-windows/release-notes • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-15360
https://notcve.org/view.php?id=CVE-2020-15360
27 Jun 2020 — com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification. com.docker.vmnetd en Docker Desktop versión 2.3.0.3, permite una escalada de privilegios debido a una falta de verificación del cliente • https://docs.docker.com/docker-for-windows/release-notes • CWE-862: Missing Authorization •