Privilege Escalation in Docker

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors...

GHSA-WXJ3-QWV4-CVFM Privilege Escalation in Docker

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors...

Exploit for SQL Injection in Phpipam

CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin u...

Portainer code issue vulnerability

A code issue vulnerability exists in Portainer Agent, a lightweight user management interface for managing Docker environments and Docker hosts, which stems from the product's failure to associate Portainer instances with past time. An attacker could exploit the vulnerability to cause the API...

Jenkins Enterprise and Operations Center < 2.277.43.0.5 / 2.319.2.5 Multiple Vulnerabilities (CloudBees Security Advisory 2022-01-12)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.277.x prior to 2.277.43.0.5, or 2.x prior to 2.319.2.5. It is, therefore, affected by a multiple vulnerabilities, including the following: - Jenkins Docker Commons Plugin 1.17 and earlier does not...

com.facebook.presto:presto-cassandra (>=0.146, <=0.166), com.stratio.cassandra:cassandra-lucene-index-plugin (2.1.6.2) +5 more potentially affected by CVE-2021-44521 via org.apache.cassandra:cassandra-all (2.1.6)

org.apache.cassandra:cassandra-all MAVEN version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.facebook.presto:presto-cassandra =0.146, =0.1.0.final, =0.1.0.final, =0.4.0.final,...

containerd v1.2.x can be coerced into leaking credentials during image pull

Impact If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer otherwise known as a “foreign layer”, the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 o...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

Apache Tomcat Deserialization Vulnerability CVE-2020-9484...

jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution

An OS command execution vulnerability was found in the Jenkins Docker Commons plugin. Due to a lack of sanitization in the name of an image or a tag, an attacker with Item/Configure permission or the ability to control the contents of a previously configured job’s SCM repository may be able to...

org.apache.unomi:unomi-docker (>=1.5.0, <=1.5.1) potentially affected by CVE-2020-13942 via org.apache.unomi:unomi (>=1.5.0, <=1.5.1)

org.apache.unomi:unomi MAVEN version =1.5.0, =1.5.0, =1.5.1 Source cves: CVE-2020-13942 Source advisory: OSV:GHSA-XP5J-WJ4H-2JQ9...

org.apache.unomi:unomi-docker (>=1.5.0, <=1.5.1) potentially affected by CVE-2020-13942 via org.apache.unomi:unomi (>=1.5.0, <=1.5.1)

org.apache.unomi:unomi MAVEN version =1.5.0, =1.5.0, =1.5.1 Source cves: CVE-2020-13942 Source advisory: GHSA-XP5J-WJ4H-2JQ9...

com.nirima.jenkins.repository:jenkins-maven-plugin (1.2), com.nirima.jenkins.repository:pom (1.2) +7 more potentially affected by CVE-2021-43859 +1 more via org.jenkins-ci.main:jenkins-core (1.546)

org.jenkins-ci.main:jenkins-core MAVEN version 1.546 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima.jenkins.repository:jenkins-maven-plugin 1.2 - com.nirima.jenkins.repository:pom 1.2 ...

com.switchfly:gitlab-merge-request-jenkins (2.0.0), org.jenkins-ci.main:jenkins-test-harness (1.638) +4 more potentially affected by CVE-2021-43859 +1 more via org.jenkins-ci.main:jenkins-core (1.638)

org.jenkins-ci.main:jenkins-core MAVEN version 1.638 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 2.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.6...

RHEL 8 : OpenShift Container Platform 4.9.19 (RHSA-2022:0339)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0339 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

org.apache.unomi:unomi-docker (>=1.5.0, <=1.5.3) potentially affected by CVE-2020-11975 via org.apache.unomi:unomi (>=1.5.0, <=1.5.3)

org.apache.unomi:unomi MAVEN version =1.5.0, =1.5.0, =1.5.3 Source cves: CVE-2020-11975 Source advisory: GHSA-V6FQ-Q792-J46J...

org.apache.unomi:unomi-docker (>=1.5.0, <=1.5.3) potentially affected by CVE-2020-11975 via org.apache.unomi:unomi (>=1.5.0, <=1.5.3)

org.apache.unomi:unomi MAVEN version =1.5.0, =1.5.0, =1.5.3 Source cves: CVE-2020-11975 Source advisory: OSV:GHSA-V6FQ-Q792-J46J...

SocialPwned - An OSINT Tool That Allows To Get The Emails, From A Target, Published In Social Networks Such As Instagram, Linkedin And Twitter To Find Possible Credentials Leaks In PwnDB Or Dehashed And Obtain Google Account Information Via GHunt

SocialPwned is an OSINT tool that allows to get the emails, from a target, published in social networks like Instagram, Linkedin and Twitter to find the possible credential leaks in PwnDB or Dehashed and obtain Google account information via GHunt. The purpose of this tool is to facilitate the...

[SECURITY] Fedora 34 Update: podman-3.4.4-1.fc34

podman Pod Manager is a fully featured container engine that is a simple daemonless tool. podman provides a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=3Dpodman. Most...

openSUSE: Security Advisory for containerd, (openSUSE-SU-2022:0334-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Why Security in Kubernetes Isn't the Same as in Linux: Part 2

Security for Kubernetes might not be quite the same as what you're used to. In our previous article, we covered why security is so important in both Linux on-premises servers and cloud Kubernetes clusters. We also talked about 3 major aspects of Linux server security — processes, network, and fil...