EP4-redes

POC CVE-2018-15473 эксплойт Адаптировано из https://github.com/Rhynorater/CVE-2018-15473-Exploit Для запуска этого эксплойта необходимо иметь установленное: docker docker compose ssh-сервер Начнем с загрузки из DockerHub образа, содержащего старую версию 6.6 SSH на старом Ubuntu: Загрузка может...

[SECURITY] Fedora 43 Update: docker-distribution-3.1.2-1.fc43

The toolkit to pack, ship, store, and deliver container content. This package provides Docker Registry - a service for storing and distributing OCI and Docker container images...

[SECURITY] Fedora 44 Update: docker-distribution-3.1.2-1.fc44

The toolkit to pack, ship, store, and deliver container content. This package provides Docker Registry - a service for storing and distributing OCI and Docker container images...

[SECURITY] Fedora 45 Update: docker-distribution-3.1.2-1.fc45

The toolkit to pack, ship, store, and deliver container content. This package provides Docker Registry - a service for storing and distributing OCI and Docker container images...

Fedora 43 : docker-distribution (2026-e60ac68542)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e60ac68542 advisory. - Update to release v3.1.2 - Resolves: rhbz2540024 - Resolves CVE-2026-41178: rhbz2515091 - Resolves CVE-2026-85747 - Upstream fixes and enhancement...

Fedora 44 : docker-distribution (2026-6ac19bf6ee)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6ac19bf6ee advisory. - Update to release v3.1.2 - Resolves: rhbz2540024 - Resolves CVE-2026-41178: rhbz2515091 - Resolves CVE-2026-85747 - Upstream fixes and enhancement...

GO-2026-6597 vulnerabilities

Vulnerabilities for packages: docker, k8sgpt, kgateway, chaos-mesh-fips, gatekeeper, tigera-operator, trivy-operator, datadog-agent-fips, skaffold, consul-k8s-fips, skaffold-fips, kubescape-server-fips, gitlab-rails-ce, scorecard, kaniko, harvester-fips, eksctl, kubescape, envoy-gateway, dagger,...

Command Injection

Overview @nx/docker is a The Nx Plugin for Docker to aid in containerizing projects. Affected versions of this package are vulnerable to Command Injection via the docker tag, docker push, and docker images calls in the release pipeline, where registry URL, repository name, version scheme,...

CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104859

The Nx monorepo solution for TypeScript and polyglot codebases is vulnerable to OS command injection in the @nx/docker release pipeline. In versions 21.4.0 until 22.7.8 and 23.0.0 until 23.1.1 , the release.docker.repositoryName and registryUrl configuration values are interpolated into shell com...

CVE-2026-97687 vulnerabilities

Vulnerabilities for packages: py3-pipenv, kubeflow-pipelines, kubeflow-pipelines-visualization-server, jwt-tool, pypy-3.10, py3-cassandra-medusa, kserve, confluent-docker-utils, datadog-agent, py3-pip, open-webui, superset...

CVE-2026-97688 vulnerabilities

Vulnerabilities for packages: py3-pipenv, kubeflow-pipelines, kubeflow-pipelines-visualization-server, jwt-tool, pypy-3.10, py3-cassandra-medusa, kserve, confluent-docker-utils, datadog-agent, py3-pip, open-webui, superset...

GHSA-8988-9CW3-XX77 vulnerabilities

Vulnerabilities for packages: py3-pipenv, kubeflow-pipelines, kubeflow-pipelines-visualization-server, jwt-tool, pypy-3.10, py3-cassandra-medusa, kserve, confluent-docker-utils, datadog-agent, py3-pip, open-webui, superset...

GHSA-GH4C-6FX4-QH6G vulnerabilities

Vulnerabilities for packages: py3-pipenv, kubeflow-pipelines, kubeflow-pipelines-visualization-server, jwt-tool, pypy-3.10, py3-cassandra-medusa, kserve, confluent-docker-utils, datadog-agent, py3-pip, open-webui, superset...

PT-2026-104410

Name of the Vulnerable Software and Affected Versions Nx versions 21.4.0 through 22.7.7 Nx versions 23.0.0 through 23.1.0 Description The @nx/docker release pipeline constructs docker tag, image lookup, and docker push invocations as shell command strings. The configuration values...

PT-2026-104588

Name of the Vulnerable Software and Affected Versions act runner affected versions not specified Description The act runner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When privileged mode is disabled, the system only forces the...

Fedora 45 : docker-distribution (2026-13584cfe41)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-13584cfe41 advisory. - Update to release v3.1.2 - Resolves: rhbz2540024 - Resolves CVE-2026-41178: rhbz2515091 - Resolves CVE-2026-85747 - Upstream fixes and enhancement...

CVE-2026-104859: Improper Neutralization of Special Elements used in an OS Command

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...