CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-11492
https://notcve.org/view.php?id=CVE-2020-11492
05 Jun 2020 — An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges. Se detectó un problema en Docker Desktop versiones hasta 2.2.0.5 en Windows. Si un atacante local configura su propia tubería nombrada antes de iniciar Docker con el mismo nombre, este atacante puede interceptar un i... • https://github.com/CrackerCat/CVE-2020-11492 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 1CVE-2020-10665
https://notcve.org/view.php?id=CVE-2020-10665
18 Mar 2020 — Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker Desktop for Windows Stable before 2.2.0.4, and Docker Desktop for Windows Edge before 2.2.2.0. Docker Desktop permite una escalada de privilegios locales a NT AUTHORITY\SYSTEM porque maneja inapropiadamente la colección... • https://github.com/spaceraccoon/CVE-2020-10665 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •