CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23774 – Docker Desktop Link Following Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-23774
Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files. Docker Desktop versiones anteriores a 4.4.4 en Windows, permite a atacantes mover archivos arbitrarios This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Docker Desktop Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://docs.docker.com/docker-for-windows/release-notes •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-45449
https://notcve.org/view.php?id=CVE-2021-45449
Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files. Docker Desktop versiones 4.3.0 y 4.3.1, presenta un bug que puede registrar información confidencial (token de acceso o contraseña) en la máquina del usuario durante el inicio de sesión. Esto sólo afecta a usuarios si están en Docker Desktop versiones 4.3.0, 4.3.1 y el usuario ha iniciado la sesión mientras está en versiones 4.3.0, 4.3.1. • https://docs.docker.com/desktop/windows/release-notes • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-37841
https://notcve.org/view.php?id=CVE-2021-37841
Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with low privilege to read, write and possibly even execute code inside the containers. Docker Desktop versiones anteriores a 3.6.0, sufre de un control de acceso incorrecto. Si una cuenta poco privilegiada es capaz de acceder al servidor que ejecuta los contenedores de Windows, puede conllevar a un compromiso del contenedor completo en los modos de aislamiento de procesos y de aislamiento de Hyper-V. • https://docs.docker.com/docker-for-windows/release-notes • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-15360
https://notcve.org/view.php?id=CVE-2020-15360
com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification. com.docker.vmnetd en Docker Desktop versión 2.3.0.3, permite una escalada de privilegios debido a una falta de verificación del cliente • https://docs.docker.com/docker-for-windows/release-notes https://whitehatck01.blogspot.com/2020/06/dockers-latest-version-of-privilege.html • CWE-862: Missing Authorization •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-11492
https://notcve.org/view.php?id=CVE-2020-11492
An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges. Se detectó un problema en Docker Desktop versiones hasta 2.2.0.5 en Windows. Si un atacante local configura su propia tubería nombrada antes de iniciar Docker con el mismo nombre, este atacante puede interceptar un intento de conexión desde Docker Service (que se ejecuta como SYSTEM) y luego suplantar sus privilegios • https://github.com/CrackerCat/CVE-2020-11492 https://docs.docker.com/docker-for-windows/release-notes https://www.pentestpartners.com/security-blog/docker-desktop-for-windows-privesc-cve-2020-11492 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •