Docker

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and…

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as r…

A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default.

A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privileges to SYSTEM.

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory.

Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action (via escape sequence in…

In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.

Docker Compose trusts the path information embedded in remote OCI compose artifacts.

Moby is an open source container framework.

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

An issue was found in Docker before 1.6.0.

The official composer docker images before 1.8.3 contain a blank password for a root user.

The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user.

The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user.

The official notary docker images before signer-0.6.1-1 contain a blank password for a root user.

Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user.

The official storm Docker images before 1.2.1 contain a blank password for a root user.

The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user.

The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user.

The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user.

The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user.

The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user.

The official spiped docker images before 1.5-alpine contain a blank password for a root user.

The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user.

In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does.