Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
481 results · page 8 of 10
Jul 15, 2021IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in thCVE-2021-20499 · Other software · IBM · reported by psirt@us.ibm.comLow 2.7
IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197973
- Product
- Security Verify Access Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 15, 2021IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system.CVE-2021-20498 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972.
- Product
- Security Verify Access Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 15, 2021IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informationCVE-2021-20497 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 197969
- Product
- Security Verify Access Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 15, 2021IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation.CVE-2021-20496 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation. IBM X-Force ID: 197966.
- Product
- Security Verify Access Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 15, 2021IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized usCVE-2021-20439 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized user.
- Product
- Security Verify Access Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 9, 2021The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potenCVE-2020-15378 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.3
The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potential attack surface.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 1, 2021Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18.CVE-2021-33183 · Network & remote access · Synology · reported by security@synology.comHigh 7.9
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18.09.0-0515 allows local users to read or write arbitrary files via unspecified vectors.
- Product
- Synology Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Mar 1, 2021rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an APICVE-2021-27886 · Other software · Docker Dashboard Project · reported by MITRECritical 9.8
rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an API request. NOTE: this is NOT a Docker, Inc. product.
- Product
- Docker Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 23, 2021A privilege escalation flaw was found in openshift4/ose-docker-builder.CVE-2021-20182 · Other software · Redhat · reported by Red HatHigh 8.8
A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted environment instead of runc. If an attacker can gain access to this build container, they can potentially utilize the raw devices of the underlying node, such as the network and storage devices, to at least escalate their privileges to that of the cluster admin. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Product
- Openshift Container Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Feb 2, 2021In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemonCVE-2021-21285 · Other software · moby · reported by GitHubMedium 6.5
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comgithub.com
Feb 2, 2021In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalaCVE-2021-21284 · Other software · moby · reported by GitHubMedium 6.8
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comgithub.com
Jan 26, 2021Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to CVE-2021-3193 · Other software · Nagios · reported by MITRECritical 9.8
Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2021Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery.CVE-2020-26278 · Other software · weaveworks · reported by GitHubMedium 5.8
Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. Weave Net is supplied with a manifest that runs pods on every node in a Kubernetes cluster, which are responsible for managing network connections for all other pods in the cluster. This requires a lot of power over the host, and the manifest sets `privileged: true`, which gives it that power. It also set `hostPID: true`, which gave it the ability to access all other processes on the host, and write anywhere in the root filesystem of the host. This setting was not necessary, and is being removed. You are only vulnerable if you have an additional vulnerability (e.g. a bug in Kubernetes) or misconfiguration that allows an attacker to run code inside the Weave Net pod, No such bug is known at the time of release, and there are no known instances of this being exploited. Weave Net 2.8.0 removes the hostPID setting and moves CNI plugin install to an init container. Users who do not update to 2.8.0 can edit the ho
- Product
- weave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2021Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.CVE-2021-3162 · Other software · Docker · reported by MITREHigh 7.8
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
- Product
- Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comtwitter.com
Jan 12, 2021Windows Docker Information Disclosure VulnerabilityCVE-2021-1645 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5
Windows Docker Information Disclosure Vulnerability
- Product
- Windows Server version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.compacketstormsecurity.com
Dec 30, 2020util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed withCVE-2020-27534 · Other software · Docker · reported by MITREMedium 5.3
util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.
- Product
- Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orggithub.com
Dec 16, 2020The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35197 · Other software · Docker · reported by MITRECritical 9.8
The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. System using the memcached docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Memcached Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35196 · Other software · Docker · reported by MITRECritical 9.8
The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user. System using the rabbitmq docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Rabbitmq Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35195 · Other software · Docker · reported by MITRECritical 9.8
The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Haproxy Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official vault docker images before 0.11.6 contain a blank password for a root user.CVE-2020-35192 · Other software · Hashicorp · reported by MITRECritical 9.8
The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35191 · Websites & servers · Drupal · reported by MITRECritical 9.8
The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Drupal Docker Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35190 · Other software · Plone · reported by MITRECritical 9.8
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user.CVE-2020-35186 · Other software · Docker · reported by MITRECritical 9.8
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official composer docker images before 1.8.3 contain a blank password for a root user.CVE-2020-35184 · Other software · Docker · reported by MITRECritical 9.8
The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Composer Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35189 · Other software · Kong · reported by MITRECritical 9.8
The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Kong Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35187 · Other software · Influxdata · reported by MITRECritical 9.8
The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. System using the telegraf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Telegraf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35185 · Other software · Docker · reported by MITRECritical 9.8
The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Ghost Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user.CVE-2020-35469 · Other software · Softwareag · reported by MITRECritical 9.8
The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versions of the Terracotta Server OSS container may allow a remote attacker to achieve root access with a blank password.
- Product
- Terracotta Server OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Appbase streams Docker image 2.1.2 contains a blank password for the root user.CVE-2020-35468 · Other software · Appbase · reported by MITRECritical 9.8
The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams container may allow a remote attacker to achieve root access with a blank password.
- Product
- Streams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35193 · Other software · Sonarsource · reported by MITRECritical 9.8
The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Sonarqube Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user.CVE-2020-35467 · Other software · Docker · reported by MITRECritical 9.8
The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Docker Docs container may allow a remote attacker to achieve root access with a blank password.
- Product
- Docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Blackfire Docker image through 2020-12-14 contains a blank password for the root user.CVE-2020-35466 · Other software · Blackfire · reported by MITRECritical 9.8
The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Blackfire container may allow a remote attacker to achieve root access with a blank password.
- Product
- Blackfire Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user.CVE-2020-35464 · Other software · Weave · reported by MITRECritical 9.8
Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the Weave Cloud Agent container may allow a remote attacker to achieve root access with a blank password.
- Product
- Cloud Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user.CVE-2020-35463 · Other software · Instana · reported by MITRECritical 9.8
Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed using affected versions of the Instana Dynamic APM container may allow a remote attacker to achieve root access with a blank password.
- Product
- Dynamic APM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user.CVE-2020-35462 · Other software · Coscale Agent Project · reported by MITRECritical 9.8
Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the CoScale agent container may allow a remote attacker to achieve root access with a blank password.
- Product
- Coscale Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2020Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user.CVE-2020-29591 · Other software · Docker · reported by MITRECritical 9.8
Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may allow a remote attacker to achieve root access with a blank password.
- Product
- Registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29602 · Other software · Irssi · reported by MITRECritical 9.8
The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System using the irssi docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official notary docker images before signer-0.6.1-1 contain a blank password for a root user.CVE-2020-29601 · Other software · Docker · reported by MITRECritical 9.8
The official notary docker images before signer-0.6.1-1 contain a blank password for a root user. System using the notary docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Notary Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official spiped docker images before 1.5-alpine contain a blank password for a root user.CVE-2020-29581 · Other software · Docker · reported by MITRECritical 9.8
The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Spiped Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official storm Docker images before 1.2.1 contain a blank password for a root user.CVE-2020-29580 · Other software · Docker · reported by MITRECritical 9.8
The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Storm Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user.CVE-2020-29579 · Other software · Express-gateway · reported by MITRECritical 9.8
The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
- Product
- Express-gateway Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official znc docker images before 1.7.1-slim contain a blank password for a root user.CVE-2020-29577 · Other software · ZNC · reported by MITRECritical 9.8
The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- ZNC Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user.CVE-2020-29576 · Other software · Eggheads · reported by MITRECritical 9.8
The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Eggdrop Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29575 · Other software · Docker · reported by MITRECritical 9.8
The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir Linux Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Elixir Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user.CVE-2020-29564 · Other software · Hashicorp · reported by MITRECritical 9.8
The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Consul Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29578 · Other software · Matomo · reported by MITRECritical 9.8
The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
- Product
- Piwik Fpm-alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2020In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file beinCVE-2020-8564 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 4.7
In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.
- Product
- Kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Dec 2, 2020The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user.CVE-2020-29389 · Other software · Docker · reported by MITRECritical 9.8
The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user. System using the Crux Linux Docker container deployed by affected versions of the Docker image may allow an attacker to achieve root access with a blank password.
- Product
- Crux Linux Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2020HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume CVE-2020-28348 · Other software · Hashicorp · reported by MITREMedium 6.5
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
- Product
- Nomad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2020In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) becaCVE-2020-26213 · Other software · kitabisa · reported by GitHubMedium 5.9
In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) because it doesn't get process ID and process group ID of teler properly to kills. The issue is patched in teler 0.0.1 and 0.0.1-dev5.1.
- Product
- teler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.