82 matches found
vulnerable-container-hub
El Proyecto OWASP Vulnerable Container Hub Antecedentes Existen muchos repositorios que ofrecen entornos vulnerables, como aplicaciones web, contenedores o máquinas virtuales, para quienes quieren aprender seguridad, ya que esto ayuda no solo a estudiantes o a quienes se han incorporado...
subpath-exploit
Ejemplo de Escape de Kubernetes mediante CVE-2017-1002101 Descripción Después de conocer el problema y seguir esta guía, quise explorar un poco más. Este repositorio contiene un par de despliegues de pods y scripts auxiliares de shell que demuestran el mecanismo de ataque de la manera más simple...
CVE-2026-41900-POC
OpenLearnX-RCE RCE no autenticado en OpenLearnX mediante montaje de volumen de contenedor Descubrimiento basado en diff → Parche silencioso → Escape de sandbox → Divulgación completa de /tmp...
EUVD-2026-58187
podman quadlet install --replace does not fully replace the old file...
CVE-2022-23648-POC
PoC para CVE-2022-23648 Esto es una prueba de concepto para el CVE-2022-23648 de @fel1x. Información de la divulgación aquí, información del CVE aquí y un blog con más información e ideas de mitigación aquí. El Containerfile tiene la información necesaria, y puedes cambiar el destino del VOLUME...
CVE-2026-84510
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted volume may lead to unexpected system termination...
CVE-2026-84510
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted volume may lead to unexpected system termination...
CVE-2025-70819
Zettlab D6 Ultra before 1.7.0 is vulnerable to a directory traversal flaw in its compose-file volume handling. An attacker with low-privilege local access can craft a volume entry using repeated .. segments (e.g., ../../../../../../../etc:/h_etc:rw) to mount the host's /etc/passwd and /etc/shadow...
SUSE CVE-2026-72470
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...
EUVD-2025-210712
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext...
PT-2026-71070
Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The software fails to properly handle decryption errors, which allows encrypted volumes to be mounted as plaintext. Recommendations Update to version 7.7.4 or later...
CVE-2026-17626
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...
CVE-2026-17626
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...
EUVD-2026-53473
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...
CVE-2026-17626
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...
CVE-2026-44180
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 root, and...
CVE-2026-44180 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 root, and...
CVE-2026-41013 Tenant-controlled comma smuggles arbitrary CIFS mount options
Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the mount-option allowlist, enabling privilege escalation and security control bypass on multi-tenant...
GHSA-RG2X-37C3-W2RH Docker: Race condition in docker cp allows bind mount redirection to host path
Summary A race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. Details When copying files into a container, the daemon sets up a temporary filesystem vie...
