CVSS: 10.0EPSS: 1%CPEs: 5EXPL: 1CVE-2019-5021
https://notcve.org/view.php?id=CVE-2019-5021
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user. Algunas versiones de las imágenes de Official Alpine Linux Docker (desde v3.3) contienen una contraseña NULL para el usuario `root`. Esta vulnerabilidad parece ser el resultado de una regresión introducida en diciembre de 2015. • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.html http://www.securityfocus.com/bid/108288 https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html https://security.netapp.com/advisory/ntap-20190510-0001 https://support.f5.com/csp/article/K25551452 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782 • CWE-258: Empty Password in Configuration File •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-5543
https://notcve.org/view.php?id=CVE-2018-5543
The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which may lead to disclosure of the credentials used by the container. F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) pasa el nombre de usuario y la contraseña de BIG-IP como parámetros de la línea de comandos, lo que podría conducir a la divulgación de las credenciales empleadas por el contenedor. • http://www.securityfocus.com/bid/104944 https://support.f5.com/csp/article/K58935003 • CWE-522: Insufficiently Protected Credentials •